GuidePoint Security provides trusted cybersecurity expertise, solutions and services that help organizations make better decisions and minimize risk. By taking a three-tiered, holistic approach for evaluating security posture and ecosystems, GuidePoint enables some of the nation’s top organizations, such as Fortune 500 companies and U.S. government agencies, to identify threats, optimize resources and integrate best-fit solutions that mitigate risk.
General Description
The Recovery & Restoration Consultant is a foundational member of the Incident Management & Recovery team, responsible for supporting the rebuild and securing of infrastructure environments following ransomware or other destructive cyber incidents. This role combines developing on-premises infrastructure expertise (Active Directory, VMware/Hyper-V, networking, backups) with growing Microsoft 365 and Azure/Entra ID knowledge.
You will support hands-on rebuild efforts across identity, compute, storage, networking, and cloud layers — working directly with clients, the GuidePoint Security Incident Response team, and senior engineers to restore business operations quickly, securely, and safely. This position reports to senior engineers and the R&R Engineering Manager, with the expectation of rapid growth through mentorship and real-world engagement experience.
Roles and Responsibilities:
- Support IT recovery projects involving on-premises endpoint and network infrastructure, Entra ID (Azure AD), and Microsoft 365 under the guidance of senior engineers
- Assist in developing technical remediation and restoration plans tailored to the impact on a client's environment
- Implement network containment and isolation measures on common firewall platforms in preparation for recovery efforts
- Assist in rebuilding Active Directory domains, DNS/DHCP, and Group Policy structures to a clean baseline
- Support restoration and validation of virtualized workloads (VMware ESXi, Hyper-V) and critical file/application servers
- Assist in recovering and securing Entra ID identities, Conditional Access policies, and synchronization with on-prem AD via Entra Connect
- Support rebuilds of Exchange Online, SharePoint, OneDrive, and Teams configurations
- Validate and restore data from backups (Veeam, Rubrik, Datto, etc.), ensuring integrity and cleanliness — understanding the critical difference between snapshots and proper isolated backups
- Utilize common remote management tools and VPN connections to assist impacted clients remotely
- Apply industry-standard Microsoft hardening guidelines throughout recovery processes
- Assist in implementing compliance controls such as MFA, Defender for Office 365, and Purview
- Develop and maintain PowerShell scripts for recurring recovery workflows
- Maintain thorough documentation of rebuilt configurations, recovery timelines, and actions taken — supporting defensible, auditable records for insurance carriers and legal counsel
- Maintain chain of custody awareness when handling evidence, disk images, or log files
Required Experience:
Windows & Active Directory Fundamentals
- Solid understanding of Active Directory as a centralized directory service for authentication and authorization
- Knowledge of AD objects (users, computers, groups, OUs) and Domain Controller roles (NTDS.dit, replication)
- Clear understanding of the difference between local administrator accounts (SAM database) and domain administrator accounts (Domain Admins group), including the security implications of each
- Ability to identify which domain controller a machine is authenticating against (e.g., %LOGONSERVER%, nltest, Get-ADDomainController)
- Working knowledge of Group Policy — purpose, GPO linking (sites, domains, OUs), and common enforcement use cases (password policies, drive mappings, firewall rules, USB restrictions)
- Understanding of why network isolation is the first step in a ransomware recovery scenario (containment, forensic preservation, preventing reintroduction of threats)
Cloud & Identity Basics
- Understanding of the distinction between on-premises Active Directory and Entra ID (Azure AD) — their respective roles and how they coexist in hybrid identity environments
- Familiarity with Entra Connect and hybrid identity synchronization concepts
- Solid understanding of MFA — what it is, why it's critical during recovery, and awareness that attackers target MFA (disabling it, registering rogue devices)
- Basic awareness of Conditional Access policies and their role in identity security
PowerShell Fundamentals
- Understanding of PowerShell as an object-oriented shell/scripting language and how it differs from cmd.exe (structured objects vs. plain text)
- Familiarity with cmdlet naming conventions (Verb-Noun) and basic commands (Get-Process, Get-Service, piping, Where-Object, Sort-Object)
- Understanding of execution policies (Get-ExecutionPolicy, Set-ExecutionPolicy, RemoteSigned, Bypass) and their security purpose
- Willingness and ability to write and modify scripts for recovery tasks; experience with AzureAD, ExchangeOnline, or Graph API modules is a plus
Virtualization Basics
- Understanding of hypervisor concepts — what they do and the difference between Type 1 (bare-metal: ESXi, Hyper-V, Proxmox) and Type 2 (hosted: VMware Workstation, VirtualBox)
- Clear understanding of the difference between VM snapshots and proper backups — snapshots reside on the same storage and are not a substitute for offsite/isolated backups
- Awareness that threat actors specifically target and delete snapshots and VSS shadow copies to prevent rollback
Troubleshooting & Problem-Solving
- Demonstrated ability to apply a logical, layered troubleshooting approach (physical → network → service) rather than random guessing
- Instinct to start simple (power, ping, physical connectivity) and progressively narrow scope
- Ability to isolate whether an issue is service-specific or host-wide
- Awareness of when to escalate — knowing the limits of your knowledge is a strength, not a weakness
- Embraces emerging technologies, including AI tools, to work smarter, solve problems, and drive better business outcomes.
Preferred Requirements
- 1–3 years of experience in infrastructure engineering, IT support, or systems administration roles
- Exposure to consulting, MSP, or IT environments with diverse client infrastructure
- Microsoft certifications (e.g., AZ-900, AZ-104, MS-900, SC-900) or equivalent hands-on experience
- Familiarity with at least one EDR or security platform (CrowdStrike, SentinelOne, Microsoft Defender)
- Any prior exposure to incident response, disaster recovery, or high-pressure IT scenarios
- Home lab experience or self-driven technical projects demonstrating curiosity and initiative
Networking Fundamentals
- Understanding of IP addressing and subnet masks (network vs. host portion, common private ranges)
- Knowledge of the difference between TCP (connection-oriented, reliable) and UDP (connectionless, low overhead) and common use cases for each
- Understanding of VPN concepts — encrypted tunnels over untrusted networks, their role in secure remote engagement access, and least-privilege/segmented access principles
- Basic familiarity with firewall platforms and network segmentation concepts
Incident Response & Documentation
- Understanding of why thorough documentation is critical during IR engagements — creating defensible, auditable records for insurance carriers, legal counsel, and forensic review
- Awareness that undocumented actions can be indistinguishable from attacker activity during later analysis
- Basic understanding of chain of custody — maintaining an unbroken, documented record of evidence handling (labeling, hashing, logging)
- Ability to support clean handoffs between team members or shifts on 24/7 engagements
Disaster Recovery Awareness
- Understanding of RTO (Recovery Time Objective) and RPO (Recovery Point Objective)
- Basic awareness of how these objectives shape recovery prioritization during an engagement
Additional Requirements:
- Travel up to 50% may be required to client sites as required to perform recovery activities and on-site validation.
- Participate in after-hours response rotations.
Physical Requirements:
- Sedentary work
- Substantial movement of the wrists, hands, and/or fingers for a minimum of 8 hours a day
- Required to have close visual acuity to view computer terminal and/or extensive reading for a minimum of 8 hours a day
We use Greenhouse Software as our applicant tracking system and Zoom Scheduler for HR screen request scheduling. At times, your email may block our communication with you. Please be sure to check your SPAM folder so that you don't miss updates on your application.
Why GuidePoint?
GuidePoint Security is a rapidly growing, profitable, privately-held value added reseller that focuses exclusively on Information Security. Since its inception in 2011, GuidePoint has grown to over 1,200 employees, established strategic partnerships with leading security vendors, and serves as a trusted advisor to more than 6,200 customers.
Firmly-defined core values drive all aspects of the business, which have been paramount to the company’s success and establishment of an enjoyable workplace atmosphere. At GuidePoint, your colleagues are knowledgeable, skilled, and experienced and will seek to collaborate and provide mentorship and guidance at every opportunity.
This is a unique and rare opportunity to grow your career along with one of the fastest growing companies in the nation.
Some added perks….
- Remote workforce primarily (U.S. based only, some travel may be required for certain positions, working on-site may be required for Federal positions)
- Group Medical Insurance options: Zero Deductible PPO Plan (GuidePoint pays 90% of the premium for employees and 70% for family plans (spouse/children/family) or High Deductible Health Plan with HSA (GuidePoint pays 100% of the employees premiums and 75% for family plans (spouse/children/family). If you choose the High Deductible / HSA plan, GPS will contribute in 4 equal quarterly installments: ($850 per EE annually / $1750 per family annually (includes spouse/children/family options)
- Group Dental Insurance: GuidePoint pays 100% of the premium for employees and 75% of family plans
- 12 corporate holidays and a Flexible Time Off (FTO) program
- Healthy mobile phone and home internet allowance
- Eligibility for retirement plan after 2 months at open enrollment
- Pet Benefit Option
Croatia
Spain
United States