Principal Consultant, Incident Recovery Operations (Unit 42)
About The Position
The Principal Consultant, Incident Recovery Operations (Unit 42) is a senior, field-tested role leading organizations through major outages, ransomware attacks, and breaches. The consultant makes critical decisions under pressure and with incomplete information, guides recovery efforts, and uses AI technologies to enhance security solutions. The role requires bringing executives and technical teams together around a unified recovery strategy, including when standard recovery plans, backups, or vendor solutions fail. The position is remote and includes travel to client sites up to 30% of the time, as well as after-hours or weekend support. Compensation depends on qualifications, experience, and work location. The expected annual base salary range is $157,600–$216,700; compensation may also include restricted stock units and a bonus.
Requirements
- 8+ years of proven field experience managing and leading organizations through real-world incident recovery and crisis situations.
- Demonstrated creativity in solving massive, novel technical problems under extreme pressure while client-facing.
- Proven ability to utilize AI technologies as a force multiplier to enhance and improve security answers and solutions.
- Exceptional executive presence and ability to communicate effectively with panicked C-level executives and exhausted technical staff.
- Strong self-driven motivation, with a track record of elevating team performance, mentoring junior consultants, and proactively sharing knowledge.
Nice To Haves
- Expertise in Active Directory security architecture, including tiering, privileged access, and identity recovery (KRBTGT resets).
- Experience with review tools such as PingCastle, BloodHound, and Purple Knight.
- Strong understanding of Microsoft Entra ID, SSO, MFA, and modern authentication protocols.
- Experience with enterprise backup solutions, specifically protection, isolation, and validation of backups.
- Knowledge of EDR/XDR functions and deployment strategies.
- Proficiency in WAN/LAN security architecture and network segmentation.
- Familiarity with virtualization platforms (VMware vSphere/ESXi, Hyper-V) and their respective hardening guides.
- Experience in cloud and hybrid-cloud security architecture across AWS, Azure, and GCP.
- Working knowledge of frameworks such as NIST CSF and CIS Benchmarks for hardening environments.
- Prior experience in incident response, MSP, or consulting, along with familiarity with HIPAA and PCI DSS.
- Experience with Infrastructure as Code tooling (Terraform, Ansible, Packer).
- Experience securing macOS in an enterprise environment.
Responsibilities
- Lead recovery efforts from major outages, ransomware attacks, and breaches, driving next steps during critical bridge calls.
- Make rapid, high-stakes decisions with incomplete information during active crises and confidently stand behind them.
- Determine whether to repair existing infrastructure or rebuild from scratch, managing the consequences of those technical decisions.
- Translate complex technical risks into clear business terms to secure prompt decisions from C-level executives.
- Direct and align cross-functional, non-reporting teams, including client staff, vendors, and MSPs, toward a unified recovery goal.
- Improvise effective recovery strategies when standard plans, backups, or vendor solutions fail to deliver.
- Travel to client sites up to 30% of the time and provide crucial after-hours or weekend support.
Benefits
- The offered compensation may include restricted stock units and a bonus.
- A description of employee benefits is available through the company.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Principal
Education Level
No Education Listed
