Recovery & Restoration Consultant - Remote (Anywhere in the U.S.)

General Description

The Recovery & Restoration Consultant is a foundational member of the Incident Management & Recovery team, responsible for supporting the rebuild and securing of infrastructure environments following ransomware or other destructive cyber incidents. This role combines developing on-premises infrastructure expertise (Active Directory, VMware/Hyper-V, networking, backups) with growing Microsoft 365 and Azure/Entra ID knowledge.

You will support hands-on rebuild efforts across identity, compute, storage, networking, and cloud layers — working directly with clients, the GuidePoint Security Incident Response team, and senior engineers to restore business operations quickly, securely, and safely. This position reports to senior engineers and the R&R Engineering Manager, with the expectation of rapid growth through mentorship and real-world engagement experience.

Roles and Responsibilities:  

• Support IT recovery projects involving on-premises endpoint and network infrastructure, Entra ID (Azure AD), and Microsoft 365 under the guidance of senior engineers
• Assist in developing technical remediation and restoration plans tailored to the impact on a client's environment
• Implement network containment and isolation measures on common firewall platforms in preparation for recovery efforts
• Assist in rebuilding Active Directory domains, DNS/DHCP, and Group Policy structures to a clean baseline
• Support restoration and validation of virtualized workloads (VMware ESXi, Hyper-V) and critical file/application servers
• Assist in recovering and securing Entra ID identities, Conditional Access policies, and synchronization with on-prem AD via Entra Connect
• Support rebuilds of Exchange Online, SharePoint, OneDrive, and Teams configurations
• Validate and restore data from backups (Veeam, Rubrik, Datto, etc.), ensuring integrity and cleanliness — understanding the critical difference between snapshots and proper isolated backups
• Utilize common remote management tools and VPN connections to assist impacted clients remotely
• Apply industry-standard Microsoft hardening guidelines throughout recovery processes
• Assist in implementing compliance controls such as MFA, Defender for Office 365, and Purview
• Develop and maintain PowerShell scripts for recurring recovery workflows
• Maintain thorough documentation of rebuilt configurations, recovery timelines, and actions taken — supporting defensible, auditable records for insurance carriers and legal counsel
• Maintain chain of custody awareness when handling evidence, disk images, or log files

Required Experience: 

Windows & Active Directory Fundamentals

• Solid understanding of Active Directory as a centralized directory service for authentication and authorization
• Knowledge of AD objects (users, computers, groups, OUs) and Domain Controller roles (NTDS.dit, replication)
• Clear understanding of the difference between local administrator accounts (SAM database) and domain administrator accounts (Domain Admins group), including the security implications of each
• Ability to identify which domain controller a machine is authenticating against (e.g., %LOGONSERVER%, nltest, Get-ADDomainController)
• Working knowledge of Group Policy — purpose, GPO linking (sites, domains, OUs), and common enforcement use cases (password policies, drive mappings, firewall rules, USB restrictions)
• Understanding of why network isolation is the first step in a ransomware recovery scenario (containment, forensic preservation, preventing reintroduction of threats)

Cloud & Identity Basics

• Understanding of the distinction between on-premises Active Directory and Entra ID (Azure AD) — their respective roles and how they coexist in hybrid identity environments
• Familiarity with Entra Connect and hybrid identity synchronization concepts
• Solid understanding of MFA — what it is, why it's critical during recovery, and awareness that attackers target MFA (disabling it, registering rogue devices)
• Basic awareness of Conditional Access policies and their role in identity security

PowerShell Fundamentals

• Understanding of PowerShell as an object-oriented shell/scripting language and how it differs from cmd.exe (structured objects vs. plain text)
• Familiarity with cmdlet naming conventions (Verb-Noun) and basic commands (Get-Process, Get-Service, piping, Where-Object, Sort-Object)
• Understanding of execution policies (Get-ExecutionPolicy, Set-ExecutionPolicy, RemoteSigned, Bypass) and their security purpose
• Willingness and ability to write and modify scripts for recovery tasks; experience with AzureAD, ExchangeOnline, or Graph API modules is a plus

Virtualization Basics

• Understanding of hypervisor concepts — what they do and the difference between Type 1 (bare-metal: ESXi, Hyper-V, Proxmox) and Type 2 (hosted: VMware Workstation, VirtualBox)
• Clear understanding of the difference between VM snapshots and proper backups — snapshots reside on the same storage and are not a substitute for offsite/isolated backups
• Awareness that threat actors specifically target and delete snapshots and VSS shadow copies to prevent rollback

Troubleshooting & Problem-Solving

• Demonstrated ability to apply a logical, layered troubleshooting approach (physical → network → service) rather than random guessing
• Instinct to start simple (power, ping, physical connectivity) and progressively narrow scope
• Ability to isolate whether an issue is service-specific or host-wide
• Awareness of when to escalate — knowing the limits of your knowledge is a strength, not a weakness
• Embraces emerging technologies, including AI tools, to work smarter, solve problems, and drive better business outcomes.

Preferred Requirements

• 1–3 years of experience in infrastructure engineering, IT support, or systems administration roles
• Exposure to consulting, MSP, or IT environments with diverse client infrastructure
• Microsoft certifications (e.g., AZ-900, AZ-104, MS-900, SC-900) or equivalent hands-on experience
• Familiarity with at least one EDR or security platform (CrowdStrike, SentinelOne, Microsoft Defender)
• Any prior exposure to incident response, disaster recovery, or high-pressure IT scenarios
• Home lab experience or self-driven technical projects demonstrating curiosity and initiative

Networking Fundamentals

• Understanding of IP addressing and subnet masks (network vs. host portion, common private ranges)
• Knowledge of the difference between TCP (connection-oriented, reliable) and UDP (connectionless, low overhead) and common use cases for each
• Understanding of VPN concepts — encrypted tunnels over untrusted networks, their role in secure remote engagement access, and least-privilege/segmented access principles
• Basic familiarity with firewall platforms and network segmentation concepts

Incident Response & Documentation

• Understanding of why thorough documentation is critical during IR engagements — creating defensible, auditable records for insurance carriers, legal counsel, and forensic review
• Awareness that undocumented actions can be indistinguishable from attacker activity during later analysis
• Basic understanding of chain of custody — maintaining an unbroken, documented record of evidence handling (labeling, hashing, logging)
• Ability to support clean handoffs between team members or shifts on 24/7 engagements

Disaster Recovery Awareness

• Understanding of RTO (Recovery Time Objective) and RPO (Recovery Point Objective)
• Basic awareness of how these objectives shape recovery prioritization during an engagement

Additional Requirements:

• Travel up to 50% may be required to client sites as required to perform recovery activities and on-site validation.
• Participate in after-hours response rotations.

Physical Requirements:

• Sedentary work
• Substantial movement of the wrists, hands, and/or fingers for a minimum of 8 hours a day
• Required to have close visual acuity to view computer terminal and/or extensive reading for a minimum of 8 hours a day