Director, Post Breach Recovery/IR

Key Responsibilities: Lead technical recovery efforts during major cyber incidents Direct teams rebuilding compromised infrastructure and identity platforms Serve as a senior technical resource for complex recovery challenges Guide containment, eradication, and recovery operations Help design and execute secure rebuild strategies for enterprise environments Communicate clearly with executives, legal teams, and technical stakeholders Mentor and support consultants across multiple engagements Contribute to the development of recovery playbooks and frameworks Required Experience 8+ years in cybersecurity, incident response, or enterprise infrastructure Strong technical background in enterprise systems and identity architecture Experience with Active Directory recovery and identity security Hands-on familiarity with EDR, containment strategies, and remediation workflows Experience leading technical teams during major cyber incident Ability to operate both strategically and hands-on when needed

Preferred Qualifications: Experience leading ransomware or large-scale cyber recovery engagements Background in consulting or incident response services Experience rebuilding enterprise Active Directory or hybrid identity environments Familiarity with Entra ID, modern identity platforms, and cloud infrastructure If you thrive in high-stakes environments and want to help organizations rebuild after major cyber incidents, we'd love to hear from you.