Senior Restorarion Engineer

Tokio Marine HCC•Remote - Texas, TX

1d•Remote

About The Position

Vector3, Tokio Marine HCC’s cyber services team, is seeking a Senior Restoration Engineer for its Digital Forensics and Incident Response (DFIR) team. The role provides hands-on technical leadership for containment, recovery, and restoration during ransomware, network intrusion, destructive malware, and other cyber incidents. The engineer leads restoration from initial assessment through the safe return of critical services, while preserving forensic and containment requirements. This is not a standard infrastructure or disaster recovery role. The engineer assesses damaged or compromised environments, develops practical recovery plans, directs complex rebuilds, and validates security controls before systems return to service, often under real-time incident pressure. The position collaborates with Engagement Managers, forensic consultants, Security Operations Engineers, client IT teams, managed service providers, legal counsel, insurance carriers, and technology vendors. It also provides technical guidance to Restoration Engineers and other delivery resources. The role is remote, requires Texas residency, and involves travel up to 50%. Rotating after-hours and on-call coverage supports 24/7/365 incident response engagements.

Requirements

Bachelor’s degree in Information Technology, Computer Science, Cybersecurity, Information Systems, or a related field; equivalent professional experience may be considered.
At least 5 years of progressive experience in infrastructure engineering, systems administration, disaster recovery, incident response, or ransomware recovery, including leadership of complex restoration or recovery work.
Advanced hands-on experience administering and recovering Windows Server, Active Directory, Group Policy, DNS, DHCP, file services, and related enterprise infrastructure.
Strong experience with virtualization platforms such as VMware or Hyper-V, and with backup, replication, and disaster recovery technologies.
Working knowledge of network infrastructure and security controls, including firewalls, VPN, routing, segmentation, remote access, and endpoint security tooling.
Experience with Microsoft 365 / Entra ID and cloud or hybrid identity environments.
Demonstrated experience rebuilding systems, restoring from backup, validating clean recovery points, and troubleshooting complex infrastructure dependencies under time pressure.
Ability to participate in rotating after-hours and on-call coverage for 24/7/365 incident response engagements.
Texas residency is required.
Willingness to travel up to 50%.
Willingness to work extended or irregular hours during active incidents and remotely, at a Vector3 office, or on-site at client locations.
Ability to work independently in high-pressure environments with frequent interruptions and changing priorities; manage multiple urgent priorities; and communicate effectively in writing and verbally.

Nice To Haves

Experience in digital forensics and incident response, managed services, consulting, or another client-service environment.
Azure, AWS, or other cloud infrastructure experience.
Strong scripting or automation skills using PowerShell or similar tools.
Relevant Microsoft, VMware, Cisco, CompTIA, GIAC, or vendor certifications in infrastructure, cloud, backup, or incident response.

Responsibilities

Lead the technical restoration workstream for cyber incidents from initial assessment through return to normal operations.
Assess client environments, business-critical services, backups, identity systems, network dependencies, and security tooling to set restoration priorities and sequencing.
Develop and maintain restoration plans covering dependencies, owners, milestones, risks, and validation requirements.
Advise clients and Engagement Managers on safe recovery decisions, including whether systems should remain offline, be rebuilt, restored from backup, or replaced.
Lead and perform rebuilds and recovery of Windows servers, endpoints, Active Directory, virtualization platforms, core network services, and other critical infrastructure.
Support recovery of Microsoft 365 / Entra ID, file services, DNS, DHCP, VPN, firewalls, remote access, backup platforms, and business-critical applications.
Validate backup integrity, coordinate test restores, and establish clean recovery points before production restoration.
Guide credential resets, privileged account recovery, domain hardening, segmentation, EDR deployment, and other containment measures.
Coordinate with forensic and security operations teams to protect evidence and avoid reintroducing a threat actor during restoration.
Confirm endpoint protection, patching, access controls, logging, and network restrictions before reconnecting restored systems.
Serve as a senior technical point of contact for client IT leadership and communicate status, risks, dependencies, and next steps in restoration meetings and executive updates.
Maintain accurate records of rebuilt systems, reset credentials, changed configurations, and completed validation.
Develop reusable restoration playbooks, checklists, scripts, and standards to improve recovery service speed, quality, and consistency.
Provide technical guidance and quality review for Restoration Engineers, and support engagement scoping, estimation, and solution design.

Benefits

Competitive salary and comprehensive benefit package.
Ongoing learning and development opportunities and opportunities for career advancement.
Medical, vision, and dental coverage beginning on the first day of employment.
Basic life and disability insurance.
401(k) plan with 6% company match.
20 days of PTO and two floating holidays, prorated.
Approximately 11 paid holidays and volunteer time off.
Paid parental leave.
Wellness program including mental health services, fitness network membership, and a complimentary Headspace subscription.
Student loan matching program.
Employee discount program.