Cyber Response & Remediation Delivery Lead

RSM US LLP

. Lead remediation, containment, hardening, and recovery activities during cybersecurity incident response engagements .

Posted 11/9/2026full-timeChicago • United StatesSenior💰 $94,400 - $178,800 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in cybersecurity incident response, focusing on remediation, containment, and recovery strategies while coordinating with various stakeholders. Proficient in managing technical workstreams and providing leadership in complex troubleshooting and forensic analysis.

Highest-signal resume keywords

Cybersecurity Incident ResponseActive Directory RecoveryMicrosoft Entra IDVeeam Backup & ReplicationEDR Deployment and Management

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Remediation PlanningForensic AnalysisIncident Command CoordinationTechnical TroubleshootingBackup ValidationEndpoint ContainmentIOC-Driven InvestigationSecurity HardeningTriage CollectionRecovery Planning

Soft Skills

LeadershipCommunicationCollaborationDecision-MakingProblem-Solving

Tools & Technologies

Microsoft 365Google WorkspaceVMware vSphereMicrosoft Hyper-VWindows Server

Industry Keywords

IT AssessmentsAuditsDue DiligenceEnterprise Backup TechnologiesCyber Response Methodologies

Tech Stack

Tools & technologies

CloudCyber SecurityVMware

About the role

Key responsibilities & impact

Lead remediation, containment, hardening, and recovery activities during cybersecurity incident response engagements
Develop and manage remediation plans based on incident scope, business priorities, known compromise, forensic findings, and operational dependencies
Coordinate with Incident Command, DFIR, client IT/security teams, and other stakeholders
Translate forensic findings and indicators of compromise into actionable containment and remediation activities
Prioritize concurrent technical workstreams and maintain ownership, sequencing, dependencies, and status
Guide clients through containment decisions while balancing security, business continuity, evidence preservation, and operational impact
Lead technical and executive discussions regarding remediation strategy, recovery priorities, risks, blockers, and engagement status
Coordinate infrastructure recovery and security hardening across identity, endpoint, virtualization, network, cloud, and backup environments
Ensure change control, client authorization, documentation, rollback planning, and forensic-team coordination before impactful changes
Maintain accurate remediation tracking and communicate actions, owners, outcomes, and outstanding risks
Provide technical leadership to remediation engineers and engage directly in complex technical troubleshooting
Support development of Cyber Response remediation methodologies, playbooks, tooling, and delivery standards

Requirements

What you’ll need

4+ years acting in a similar capacity for a technology consulting firm
Experience performing broad IT assessments, audits, or due diligence
Strong hands-on or delivery experience across several technical areas
Active Directory recovery and hardening
Privileged account remediation
Authentication and identity dependencies
Microsoft Entra ID
Microsoft 365 identity and security
Google Workspace
VMware vSphere / ESXi
Microsoft Hyper-V
Windows Server environments
Core enterprise infrastructure and network services
Veeam Backup & Replication
Enterprise backup technologies
Backup validation and recovery planning
Recovery of critical infrastructure following destructive incidents
EDR deployment and management
Endpoint containment
Triage collection
IOC-driven investigation/remediation
Security visibility restoration road maps
Bachelor's degree (preferred qualification)

Benefits

Comp & perks

Competitive benefits and compensation package
Discretionary bonus based on firm and individual performance
Hybrid workstyle with in-person connection and flexibility
Reasonable accommodation for people with disabilities