Senior Restorarion Engineer at Warrior MET Coal

Job description

Job Title: Senior Restoration Engineer, DFIR Location: Remote (Texas residency required) Employment Type: Full-Time Travel: Up to 50% Help us insure it Vector3 is Tokio Marine HCC’s cyber services team, a member of the Tokio Marine group of companies. When organizations are hit by ransomware, network intrusions, or destructive malware, Vector3 responds. Our Digital Forensics and Incident Response (DFIR) team helps clients contain the threat, investigate what happened, and return critical operations to service safely. We work alongside client IT teams, managed service providers, legal counsel, and insurance carriers. Role Overview Senior Restoration Engineer, DFIR We are seeking a Senior Restoration Engineer to provide hands-on technical leadership for containment, recovery, and restoration on Vector3 Incident Response engagements. Reporting to the Director of Engineering, this engineer will lead the restoration workstream for ransomware, network intrusion, destructive malware, and other cyber incidents. They will help clients bring critical technology services back online while preserving forensic and containment requirements. This is not a standard infrastructure or disaster recovery role. The successful candidate will assess damaged or compromised environments, build practical restoration plans, direct complex rebuild and recovery work, and validate security controls before systems return to service. They will do this under real-time pressure during active incidents. The Senior Restoration Engineer will work closely with Engagement Managers, forensic consultants, Security Operations Engineers, client IT teams, MSPs, counsel, carriers, and technology vendors, and will provide technical guidance to Restoration Engineers and other delivery resources. Key Responsibilities Lead the technical restoration workstream for ransomware, network intrusion, destructive malware, and other cyber incidents, from initial assessment through return to normal operations. Quickly assess the client’s environment, business-critical services, backups, identity systems, network dependencies, and security tooling to define restoration priorities and sequencing. Develop and maintain a practical restoration plan covering dependencies, owners, milestones, risks, and validation requirements. Advise Engagement Managers and clients on safe recovery decisions, including whether a system should stay offline, be rebuilt, be restored from backup, or be replaced. Lead and perform the rebuild and recovery of Windows servers, endpoints, Active Directory, virtualization platforms, core network services, and other critical infrastructure. Support the recovery of Microsoft 365 / Entra ID, file services, DNS, DHCP, VPN, firewalls, remote access, backup platforms, and business-critical applications. Validate backup integrity, coordinate test restores, and establish clean recovery points before production restoration. Guide credential resets, privileged account recovery, domain hardening, segmentation, EDR deployment, and other containment measures. Partner with forensic and security operations teams so that restoration does not compromise evidence or reintroduce a threat actor. Confirm endpoint protection, patching, access controls, logging, and network restrictions are in place before restored systems are reconnected. Serve as a senior technical point of contact for client IT leadership, providing clear status updates, risks, dependencies, and next steps in restoration meetings and executive updates. Maintain accurate restoration records, including systems rebuilt, credentials reset, configurations changed, and validation completed. Develop reusable restoration playbooks, checklists, scripts, and standards that improve the speed, quality, and consistency of Vector3 recovery services. Provide day-to-day technical guidance and quality review for Restoration Engineers, and support scoping, estimation, and solution design for restoration engagements. Required Qualificatio