Restoration and Recovery Lead

We are looking for talented consultants to join the Restoration & Recovery team within our growing Incident Response practice at an Associate level. These individuals will play a critical role in the continued success of our Cyber Security division.

You will work across the full lifecycle of security incidents to help our clients respond and recover, including:

• Overseeing r estoration work streams during Incident Response cases : you will be integral to supporting the Incident Response team to develop bespoke restoration strategies during live incidents, focusing on ensuring security and capability is maintained .
• Delivering hands‑on technical support to assist clients with restoration and recovery during cyber incidents.
• Leading and developing relationships with supporting restoration partners : in some cases where we need to surge additional resources through our partners, you will need to be able to manage and direct them to achieve a positive resolution .
• Developing plans, policies, and training: you will be part of a team designed to strengthen the Incident Response process regarding restoration, training the Incident Response team in this area to ensure effective collaboration during cases .
• Developing and sharing domain expertise : we will support you in growing your cyber expertise , including sharing it with the wider team through internal initiatives and programs.
• Participating in an on‑call rotation to lead our US & APAC restoration and recovery capabilities, and provide 24 x 7 x 365 client incident coverage.
• On‑site Restoration Support: in some cases, it may be beneficial to support clients locally at their data centres or office locations. You may be expected to attend their sites during the early stages of restoration to help support these efforts. The nature of this role means that some overnight and/or international travel is required .

• Variety of casework: no day will be the same . Our team responds to a huge variety of incidents for both public and corporate clients.
• Developing an understanding of Incident Response : you will have opportunities to broaden your security awareness into t he wider incident response process, learning how restoration fits into the bigger picture of a response .
• Flexible working practices: responding to incidents can be intense, high‑pressure work . We are mindful of our team’s work/life balance and offer flexible working options to support your wellbeing.

We are looking for Associates with 3 years or more relevant experience in IT Engineering, System Administration, or Infrastructure and Networking. Candidates will also have a demonstrated track record of deploying their skills specifically in IR scenarios and have experience working on time‑sensitive restoration projects for impacted clients.

Candidates with the following qualifications and experience are likely to succeed as Consultants within our Restoration & Recovery team. That said, if you don’t think you meet all of the criteria below but still are interested in the job, please apply. Nobody checks every box—we’re looking for candidates that are particularly strong in a few areas and have some interest and capabilities in others.

We nurture a culture of equality, diversity and inclusion and we are dedicated to developing a workforce that displays a variety of talents, experiences and perspectives.

• In‑depth knowledge of virtualisation ( VMware ESXi / Hyper‑V especially) and Cloud‑hosted (AWS / Azure / GCP) configuration and implementation
• In‑depth knowledge of Active Directory and Windows Domain functions, implementation, and configuration, including integrations with Azure
  
  AD functionality.
• Demonstratable experience with networking, including configuration of VLAN’s on switches and general configuration and troubleshooting of f irewalls.
• Comprehensive understanding of standard backup solution practices, restoration of data and preparing systems for introduction into production environments.

It would be advantageous for candidates to poses hands‑on technical experience with the following :

• Microsoft 365, including…