Principal Consultant, Incident Recovery Operations (Unit 42)

Palo Alto Networks•Burbank, CA

1d•Remote

About The Position

Palo Alto Networks is seeking a senior, field-tested consultant to lead organizations through real-world crises, including major outages, ransomware attacks, and breaches. The role requires making critical decisions with incomplete information under intense pressure and using AI technologies to enhance security solutions and outcomes. The consultant will lead recovery efforts, guide executives and technical teams toward a unified strategy, and determine whether existing infrastructure should be repaired or rebuilt. The role also directs cross-functional teams that may include client staff, vendors, and managed service providers. It is remote, with travel to client sites up to 30% of the time, and includes after-hours or weekend support when needed.

Requirements

At least 8 years of field experience managing and leading organizations through real-world incident recovery and crisis situations.
Demonstrated creativity solving large, novel technical problems under extreme pressure in client-facing situations.
Proven ability to use AI technologies to enhance security answers and solutions.
Exceptional executive presence and ability to communicate with C-level executives and technical staff.
Strong self-driven motivation and a track record of elevating team performance, mentoring junior consultants, and sharing knowledge.

Nice To Haves

Expertise in Active Directory security architecture, including tiering, privileged access, and identity recovery such as KRBTGT resets.
Experience with review tools such as PingCastle, BloodHound, and Purple Knight.
Strong understanding of Microsoft Entra ID, SSO, MFA, and modern authentication protocols.
Experience with enterprise backup solutions, particularly protection, isolation, and validation of backups.
Knowledge of EDR/XDR functions and deployment strategies.
Proficiency in WAN/LAN security architecture and network segmentation.
Familiarity with virtualization platforms such as VMware vSphere/ESXi and Hyper-V, and their hardening guides.
Experience in cloud and hybrid-cloud security architecture across AWS, Azure, and GCP.
Working knowledge of frameworks such as NIST CSF and CIS Benchmarks for hardening environments.
Prior experience in incident response, managed service providers, or consulting, and familiarity with HIPAA and PCI DSS.
Experience with Infrastructure as Code tools such as Terraform, Ansible, and Packer.
Experience securing macOS in an enterprise environment.

Responsibilities

Lead recovery efforts during major outages, ransomware attacks, and breaches, driving next steps during critical bridge calls.
Make rapid, high-stakes decisions with incomplete information during active crises and stand behind those decisions.
Determine whether to repair existing infrastructure or rebuild it, and manage the consequences of those technical decisions.
Translate complex technical risks into clear business terms to help C-level executives make timely decisions.
Direct and align cross-functional teams, including client staff, vendors, and managed service providers, toward a unified recovery goal.
Develop effective recovery strategies when standard plans, backups, or vendor solutions fail.
Travel to client sites up to 30% of the time and provide after-hours or weekend support.
Use AI technologies to enhance security solutions.
Mentor junior consultants, elevate team performance, and proactively share knowledge.