Job Description

Job Title: Senior Restoration Engineer, DFIR

Location: Remote (Texas residency required)

Employment Type: Full-Time

Travel: Up to 50%

Help us insure it

Vector3 is Tokio Marine HCC’s cyber services team, a member of the Tokio Marine group of companies. When organizations are hit by ransomware, network intrusions, or destructive malware, Vector3 responds. Our Digital Forensics and Incident Response (DFIR) team helps clients contain the threat, investigate what happened, and return critical operations to service safely. We work alongside client IT teams, managed service providers, legal counsel, and insurance carriers.

Role Overview

Senior Restoration Engineer, DFIR

We are seeking a Senior Restoration Engineer to provide hands-on technical leadership for containment, recovery, and restoration on Vector3 Incident Response engagements. Reporting to the Director of Engineering, this engineer will lead the restoration workstream for ransomware, network intrusion, destructive malware, and other cyber incidents. They will help clients bring critical technology services back online while preserving forensic and containment requirements.

This is not a standard infrastructure or disaster recovery role. The successful candidate will assess damaged or compromised environments, build practical restoration plans, direct complex rebuild and recovery work, and validate security controls before systems return to service. They will do this under real-time pressure during active incidents. The Senior Restoration Engineer will work closely with Engagement Managers, forensic consultants, Security Operations Engineers, client IT teams, MSPs, counsel, carriers, and technology vendors, and will provide technical guidance to Restoration Engineers and other delivery resources.

Key Responsibilities

• Lead the technical restoration workstream for ransomware, network intrusion, destructive malware, and other cyber incidents, from initial assessment through return to normal operations.
• Quickly assess the client’s environment, business-critical services, backups, identity systems, network dependencies, and security tooling to define restoration priorities and sequencing.
• Develop and maintain a practical restoration plan covering dependencies, owners, milestones, risks, and validation requirements.
• Advise Engagement Managers and clients on safe recovery decisions, including whether a system should stay offline, be rebuilt, be restored from backup, or be replaced.
• Lead and perform the rebuild and recovery of Windows servers, endpoints, Active Directory, virtualization platforms, core network services, and other critical infrastructure.
• Support the recovery of Microsoft 365 / Entra ID, file services, DNS, DHCP, VPN, firewalls, remote access, backup platforms, and business-critical applications.
• Validate backup integrity, coordinate test restores, and establish clean recovery points before production restoration.
• Guide credential resets, privileged account recovery, domain hardening, segmentation, EDR deployment, and other containment measures.
• Partner with forensic and security operations teams so that restoration does not compromise evidence or reintroduce a threat actor.
• Confirm endpoint protection, patching, access controls, logging, and network restrictions are in place before restored systems are reconnected.
• Serve as a senior technical point of contact for client IT leadership, providing clear status updates, risks, dependencies, and next steps in restoration meetings and executive updates.
• Maintain accurate restoration records, including systems rebuilt, credentials reset, configurations changed, and validation completed.
• Develop reusable restoration playbooks, checklists, scripts, and standards that improve the speed, quality, and consistency of Vector3 recovery services.
• Provide day-to-day technical guidance and quality review for Restoration Engineers, and support scoping, estimation, and solution design for restoration engagements.

Required Qualifications

• Bachelor’s degree in Information Technology, Computer Science, Cybersecurity, Information Systems, or a related field; equivalent professional experience may be considered.
• 5+ years of progressive experience in infrastructure engineering, systems administration, disaster recovery, incident response, or ransomware recovery, including leading complex restoration or recovery work.
• Advanced hands-on experience administering and recovering Windows Server, Active Directory, Group Policy, DNS, DHCP, file services, and related enterprise infrastructure.
• Strong experience with virtualization platforms such as VMware or Hyper-V, and with backup, replication, and disaster recovery technologies.
• Working knowledge of network infrastructure and security controls, including firewalls, VPN, routing, segmentation, remote access, and endpoint security tooling.
• Experience with Microsoft 365 / Entra ID and cloud or hybrid identity environments.
• Demonstrated experience rebuilding systems, restoring from backup, validating clean recovery points, and troubleshooting complex infrastructure dependencies under time pressure.
• Ability to participate in rotating after-hours and on-call coverage supporting 24/7/365 Incident Response engagements.

Preferred Qualifications

• Experience in digital forensics and incident response, managed services, consulting, or another client-service environment.
• Azure, AWS, or other cloud infrastructure experience.
• Strong scripting or automation skills using PowerShell or similar tools.
• Relevant certifications such as Microsoft, VMware, Cisco, CompTIA, GIAC, or vendor certifications in infrastructure, cloud, backup, or incident response.

Core Competencies

• Restoration Leadership: Ability to own the technical recovery workstream and drive it from assessment to return to service.
• Infrastructure Depth: Advanced, hands-on command of Windows, identity, virtualization, and backup environments.
• Secure Recovery Judgment: Ability to balance speed of recovery against containment, evidence preservation, and residual risk.
• Problem Solving Under Pressure: Ability to find alternative recovery paths when systems, configurations, or backups are unavailable.
• Client Communication: Ability to lead technical discussions with client IT leaders and executives during high-stress incidents.
• Technical Mentorship: Ability to guide, review, and raise the quality of work across restoration resources.

Skills & Attributes

• Sound technical judgment with the ability to make decisions with incomplete information.
• Ability to manage multiple urgent priorities without losing attention to detail.
• Strong written and verbal communication skills.
• Ability to work independently and effectively in high-pressure environments with frequent interruptions and rapidly changing priorities.
• Willingness to work extended or irregular hours during active incidents, and to work remotely, at a Vector3 office, or on-site at client locations.

What We Offer

• Competitive salary and comprehensive benefit package
• Strong learning culture with ongoing development opportunities
• Opportunities for growth and career advancement
• Comprehensive medical, vision, and dental coverage, with eligibility beginning on your first day of employment
• Basic life and disability insurance
• 401(k) plan with 6% company match
• 20 days of PTO and two floating holidays (prorated)
• Approximately 11 paid holidays and volunteer time off
• Paid parental leave
• Access to our award-winning wellness program, including mental health services, fitness network membership, and a complimentary Headspace subscription
• Student loan matching program
• Employee discount program
• An opportunity to do meaningful work and love what you do

About Us

Tokio Marine HCC is a global industry-leading specialty insurance group, backed by the strength and stability of the Tokio Marine Group. Offering over 100 classes of specialty insurance, we empower clients to pursue opportunities confidently through our “Mind Over Risk” philosophy. More than an insurance company, we are an organization built on innovation, unity, and trust.

At our core, we are Always Advancing, driven by innovation and an entrepreneurial spirit that keeps us moving forward. Our people are Experts in Tomorrow, using curiosity and smart working to anticipate what’s next. With a culture rooted in Reaching Out, we foster genuine collaboration and support, ensuring every individual has the opportunity to succeed and make a difference.

Applying our Mind Over Risk philosophy to writing insurance allows our customers to take on opportunity with confidence. That philosophy defines our way of thinking, unites us as a team, and differentiates us from our competitors. We are much more than just an insurance company; we are a good company.

Equal Opportunity Employer

TMHCC is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship, color, family or medical care leave, gender identity, genetic information, marital status, medical condition, national origin, physical or mental disability, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable local laws, regulations and ordinances.

#LI-TI #LI-Remote