Restoration and Recovery Lead

RESTORATION & RECOVERY LEAD, USA

S-RM is a global intelligence and cyber security consultancy that has been helping the most demanding clients solve their toughest information security challenges since 2005. Our culture is built on a team of sharp, curious, and driven individuals who think critically, solve complex problems, and achieve success. We invest daily in our people’s well‑being, learning, and ideas.

Our Cyber Security division is the fastest‑growing part of S‑RM, focused on Advisory, Ethical Hacking, and Incident Response. We respond, innovate, and improve without hierarchy or bureaucracy, empowering ideas with the opportunity to influence customers and teammates.

You will work across the full lifecycle of security incidents, primarily ransomware, to help clients respond and recover. S‑RM’s Incident Response team operates a global delivery model; you will support incidents across multiple geographies, with a focus on Europe and North America.

• Developing restoration strategies during Incident Response cases: work alongside the Incident Response team to create bespoke strategies during live incidents, ensuring security and capability are maintained.
• Executing these strategies to help clients restore operations quickly and securely: lead the execution of strategies in partnership with client IT and security teams, restoring operations in a quick and secure manner.
• Leading and developing relationships with supporting restoration partners: manage relationships and direct partner work to ensure S‑RM’s standards are met in surge scenarios.
• Capability development: contribute to the development of S‑RM’s restoration and recovery capability, creating playbooks and providing training for the broader Incident Response team.
• On‑site Restoration Support: attend client sites during early restoration stages to support local efforts when beneficial.

Due to the global nature of our Incident Response team, this role requires working in shifts, covering core US working hours (Eastern Time) as well as weekends.

• Variety of casework: no day will be the same; we respond to a huge variety of incidents for public and corporate clients.
• Developing an understanding of Incident Response: broaden your security awareness into the wider incident response process.
• Flexible working practices: we offer flexible options to support your wellbeing.

• In‑depth knowledge of on‑premise, virtualised (ESXi / Hypervisor Technology) and Cloud‑hosted (AWS/Azure/GCP) configuration and implementation.
• In‑depth knowledge of Active Directory functions, implementation, and configuration, including integrations with Entra .
• Comprehensive understanding of standard backup solution practices, restoration of data, and preparing systems for introduction into production environments.
• Comprehensive understanding of general network appliance integration and configuration, as well as security and network‑based tooling implementations.

Relevant industry certifications are not required, but Microsoft Certified Systems Administrator (MCSA), vSphere, and Network Administration qualifications are beneficial. The successful candidate must have permission to work in the United States by the start of employment.

• 20 days holiday per year, 12 public holidays, and up to 25 days of service‑based leave.
• Life insurance – 4× annual salary.
• Matching pension contribution up to 6% (12% combined) and financial education.
• Hybrid working and flexible working hours.
• Military leave up to 5 years.
• Parental support: fertility treatment leave, maternity leave (26 weeks full pay + 13 weeks half pay), and paternity leave (6 weeks full pay).
• 100% company‑paid private medical, dental, and vision insurance for employee, partner, and children.
• Gym discounts, EAP programme, and free Headspace access.

Full salary range: $145,000 – $195,000 (dependent on experience and location). Discussed further during initial calls.

A typical application process includes:

• Initial screening of your application by our recruiting team.
• An interview to assess baseline technical skills.
• An interview to discuss previous experience, broader competencies, and suitability for the role.