Technical Advisor

Arete

1d•Onsite

About The Position

The Technical Advisor partners with the Engagement Lead (EL) to manage technical tasks during an engagement, assists the client with immediate actions, and provides support for SentinelOne (S1) agent installation and troubleshooting. This role ensures data preservation, assists with forensic collections, and manages infrastructure recovery, restoration, decryption, and remediation efforts. The Technical Advisor also reviews and validates backup solutions, consults on resolving technical issues like EDR deployment and forensics collections, and ensures the Strategic Plan includes comprehensive technical details and identifies necessary resources. They serve as an internal expert on the engagement lifecycle and a technical escalation point for other technical roles. Responsibilities include documenting activities and time, backfilling the EL and other team members as needed, interfacing with client technical teams and other Arete teams, and articulating technical recommendations verbally and in writing. The role may also involve training or mentoring other technical staff, identifying and escalating underperforming team members, and delegating tasks from the EL. Other duties may be assigned by management.

Requirements

General knowledge of the Incident Response lifecycle and the tools and processes leveraged over the entire engagement
Ability to communicate technical subject matter to a non-technical audience
Sufficient knowledge of all Arete core offerings, processes, and internal/proprietary tools
Ability to lead projects with multiple stakeholders and resolve conflicts
Strong influential leadership and interpersonal skills, professional presence and experience collaborating with peers on remote teams
Strong communication and problem-solving skills
Customer service focused with proven ability to manage multiple priorities
Innovative and creative thinking skills
Previous experience scripting for automation (PowerShell, Bash, Python)
Familiarity with industry standard incident response and forensics threat hunting software and toolsets
Working knowledge of networking to include DHCP, DNS, Subnetting, VLANs, and authentication., and the ability to troubleshoot and resolve issues
General knowledge of data encryption technologies
Ability to read and understand basic network diagrams
Familiarity with small to large size network and systems environments
Basic experience identifying persistence mechanisms and developing client specific remediation steps
Experience with basic collections and troubleshooting basic collection methods (ie. powered on VM with space constraints)
Experience setting up, configuring, and troubleshooting backup and restore operations
Data recovery experience, basic understanding of data structures, file system formats, RAID configurations, and storage configurations
A Bachelors/technical degree and 6 years of experience relevant experience working in IT operations and administrating IT systems, or equivalent experience.
Advanced knowledge of multiple technologies: Multi-factor Authentication, Storage solutions, Hypervisors, Operating Systems, Networking, System Administration, Remote Monitoring and Management tools (RMMs), Log Aggregation and Collections, etc.
Thorough knowledge in at many of the following areas: virtualization, Windows Server, Linux/Unix, LDAP/Active Directory, DNS, networking, firewalls, DMZ, scripting/PowerShell, cloud solutions (Azure, AWS, etc), Microsoft 365, information security, SaaS integrations, MDM, SIEM platforms, MFA, RMM.
Ability to align tasks with the larger objective of the project engagement process.
Previous experience rebuilding applications and custom Windows servers as well as domain controllers and verifying correct operations
Ability to work onsite or during non-business hours, etc.

Nice To Haves

Technical Certifications, Cisco Networking, Security +, Microsoft Server/Azure, etc., preferred

Responsibilities

Partners with the Engagement Lead (EL) to manage the overall technical tasks during an engagement
Assists the Client with the completion of immediate actions
Assists the Client with SentinelOne (S1) agent installation and troubleshooting
Ensures data preservation steps are taken and assists with forensic collections
Manages Infrastructure Recovery/Restoration and Decryption/Remediation efforts
Reviews backup solutions and assists with the validation of backups
Consults on the resolution of all technical issues such as EDR deployment, troubleshooting, forensics collections, and onsite restoration
Ensures the Strategic Plan contains comprehensive technical details and identifies additional technical resources based on Strategic Plan task list and milestones set by the EL
Serves as an internal expert on the entire engagement lifecycle and portfolio of services at a technical level
Serves as an escalation point for Technical Advisor, Engineer, and Technician positions for both technical and non-technical issues
Ensures all activities, findings, and hourly time are properly documented
Backfills the EL as needed on kickoff calls and daily update calls, etc. and may also fill in for other team members such as SOC or Forensics, depending on their experience and skillset
Interfaces with the client's technical team members, outside technical teams, the EL, the Project Manager and other Arete Teams to ensure the overall technical success of the engagement
Clearly articulates technical recommendations for enhancing client cybersecurity and/or IT infrastructure both verbally and in in writing (as directed by Counsel)
May train or mentor other technical roles
Identifies and escalates underperforming team members to help expedite Client recovery efforts and identify mentoring opportunities
Prioritizes, actions upon, and delegates instructions and tasks provided by the EL
May perform other duties as assigned by management