Director of Incident Response

About the role

This role focuses on leading teams that restore IT operations after ransomware attacks. The Director will guide engagement scoping, distribute workload among engineering teams, and provide direct leadership during critical recovery missions. A key part of the work involves developing and refining restoration runbooks for various infrastructure types, ensuring efficient and professional recovery processes.

The successful candidate will be responsible for building and evolving team structures to enhance scalability, knowledge sharing, and delivery excellence. This includes supporting operational teams to maintain high customer satisfaction and team member engagement. The Director will also serve as an escalation point for clients and legal counsel, addressing any issues that arise during incident response.

Success in this position means effectively leading battalions of engineers and project managers to minimize the impact of ransomware attacks on client companies. This involves partnering with sales to pursue new opportunities and consistently driving high levels of customer value and profitability for Fenix24, while also fostering a strong team environment.

The annual salary for this position is between $69,000 and $115,000 USD.

Skills that matter here

• IT infrastructure engineering: This role requires a deep technical understanding of IT infrastructure to lead recovery efforts and develop restoration strategies.
• endpoint security controls: Knowledge of endpoint security is crucial for understanding attack vectors and implementing effective recovery and prevention measures.
• perimeter firewalls: Understanding perimeter firewalls is necessary to assess network security post-incident and guide restoration efforts.
• Microsoft Exchange: Experience with Microsoft Exchange is required to restore critical communication systems for affected clients.
• Office 365: Familiarity with Office 365 is essential for recovering cloud-based productivity suites after a ransomware event.
• Windows Server: Proficiency with Windows Server operating systems is needed to restore server environments and critical applications.

Who this role suits

• A leader who can provide hands-on executive guidance to engineering teams during high-stakes incidents.
• Someone with a strong technical background in IT infrastructure, capable of organizing and executing complex missions.
• An individual who excels at building and evolving team structures to maximize efficiency and expertise.
• A professional with excellent communication and relationship-building skills, able to manage client escalations and engage with sales.

From the employer

Key Responsibilities

• Help lead engagement scoping, engaging with victims of ransomware and forensic partners in the ecosystem, as well as internal subject matter experts to understand inbound opportunities and help engage the appropriate engineering team members to address the requirements.
• Manage workload distribution and team member utilization across multiple incident response engagements.
• Provide hands-on executive leadership to teams of engineers (we call them cells, led by cell majors) who are executing the mission to minimize the enormous impact of a ransomware attack.
• Drive the development, training and updating of runbooks across a wide range of infrastructure and applications for delivery of both cloud restorations and on-premises.
• Build, manage, and continually evolve team structure to maximize scale, knowledge, opportunity, delivery excellence to customers, and profitability to Fenix24.
• Support operational teams to ensure we are driving high levels of customer satisfaction and value, team member engagement, retention, growth, and profitability.
• Function as a client and counsel escalation point to address any roadblocks, communication, or other issues as they arise.
• Participate and partner with sales by engaging with clients in pursuit of opportunities.

Qualifications

• At least 10 years in IT infrastructure engineering and leadership.
• Recent experience in leading engineering teams in complex, high stakes engagements.
• Managed Services experience and/or incident response restoration both pluses (not required).
• Deep technical acumen and ability to organize/execute complex missions.
• 7+ Years of relevant IT infrastructure engineering experience including endpoint security controls, perimeter firewalls, Microsoft Exchange and Office 365, and Windows Server operating systems.
• Ability to respond to inquiries and work beyond normal business hours, provide management to engineering teams of up to 24 in team size.
• Excellent analytical, organization, and problem-solving skills.
• Demonstrated ability to plan, organize, train, evaluate and direct work of less experienced staff.
• Demonstrated strong written and oral communication skills, including strong relationship building skills.
• Ability to form relationships across all levels of the company while modeling Fenix24's culture and values.
• Bachelors or Associate degree in Information Technology.