Principal Consultant, Incident Recovery Operations (Unit 42)
Core
Lead recovery efforts from major outages, ransomware attacks, and breaches, making rapid high-stakes decisions with incomplete information under immense pressure.
Role type
Principal Consultant, Incident Recovery Operations
Builds
Unified recovery strategies and business continuity plans for clients
Domain
Cybersecurity, Incident Response, Cloud Security
Deliverable
client delivery
Required skills
Crisis leadership, Executive communication, Technical decision-making under pressure, Cross-functional team alignment, Strategic improvisation, AI utilization for security
Preferred skills
Active Directory security architecture, Identity recovery (KRBTGT), Microsoft Entra ID, EDR/XDR deployment, Cloud security (AWS/Azure/GCP), Infrastructure as Code (Terraform/Ansible), NIST CSF/CIS Benchmarks
Technologies
PingCastle, BloodHound, Purple Knight, VMware vSphere/ESXi, Hyper-V, Terraform, Ansible, Packer
Responsibilities
Lead recovery efforts from major outages, ransomware attacks, and breaches; Make rapid, high-stakes decisions with incomplete information during active crises; Determine whether to repair existing infrastructure or rebuild from scratch; Translate complex technical risks into clear business terms for C-level executives; Direct and align cross-functional, non-reporting teams toward a unified recovery goal; Improvise effective recovery strategies when standard plans fail; Travel to client sites up to 30% of the time and provide after-hours or weekend support.
