Cyber Response & Remediation Delivery Lead

We are the leading provider of professional services to the middle market globally, our purpose is to instill confidence in a world of change, empowering our clients and people to realize their full potential. Our exceptional people are the key to our unrivaled, culture and talent experience and our ability to be compelling to our clients. You’ll find an environment that inspires and empowers you to thrive both personally and professionally. There’s no one like you and that’s why there’s nowhere like RSM.

Position Summary 

The Remediation Delivery Lead is responsible for leading the technical remediation, containment, and recovery workstreams associated with complex cybersecurity incidents. This individual serves as a key delivery leader within the Cyber Response practice, coordinating technical teams, client stakeholders, incident leadership, and forensic resources to move an affected environment from active response through stabilization and recovery.

The ideal candidate combines strong technical infrastructure and cybersecurity experience with the ability to lead teams and communicate effectively during high-pressure incidents. This role requires someone who can quickly understand a client's environment, identify and prioritize remediation objectives, develop an actionable remediation strategy, coordinate execution across multiple technical workstreams, and clearly communicate progress, risks, dependencies, and decisions to both technical and executive stakeholders.

Key Responsibilities

• • Lead remediation, containment, hardening, and recovery activities during cybersecurity incident response engagements.
  • Develop and manage remediation plans based on incident scope, business priorities, known compromise, forensic findings, and operational dependencies.
  • Coordinate closely with Incident Command, Digital Forensics and Incident Response (DFIR), client IT/security teams, and other stakeholders throughout the engagement.
  • Translate forensic findings and indicators of compromise into actionable containment and remediation activities.
  • Prioritize multiple concurrent technical workstreams and maintain clear ownership, sequencing, dependencies, and status.
  • Guide clients through containment decisions while balancing security objectives, business continuity, evidence preservation, and operational impact.
  • Lead technical and executive-level discussions regarding remediation strategy, recovery priorities, risks, blockers, and overall engagement status.
  • Coordinate infrastructure recovery and security-hardening activities across identity, endpoint, virtualization, network, cloud, and backup environments.
  • Ensure appropriate change control, client authorization, documentation, rollback planning, and coordination with forensic teams before potentially impactful changes are made. This aligns directly with the change-control requirements in the remediation playbooks. 
  • Maintain accurate remediation tracking and ensure actions, owners, outcomes, and outstanding risks are clearly communicated.
  • Provide technical leadership and guidance to remediation engineers while remaining capable of engaging directly in complex technical troubleshooting when necessary.
  • Support the continued development of Cyber Response remediation methodologies, playbooks, tooling, and delivery standards.

Technical Experience

 Candidates should have strong hands-on or delivery experience across several of the following areas:

• • Active Directory and identity security
    • Active Directory recovery and hardening
    • Privileged account remediation 
    • Authentication and identity dependencies 
    • Microsoft Entra ID 
    • Microsoft 365 identity and security
       
  • Cloud and collaboration platforms
    • Microsoft 365
    • Microsoft Entra ID
    • Google Workspace
       
  • Virtualization and infrastructure
    • VMware vSphere / ESXi
    • Microsoft Hyper-V
    • Windows Server environments
    • Core enterprise infrastructure and network services
       
  • Backup and recovery
    • Veeam Backup & Replication
    • Enterprise backup technologies
    • Backup validation and recovery planning
    • Recovery of critical infrastructure following destructive incidents
       
  • Endpoint security and incident response
    • EDR deployment and management
    • Endpoint containment
    • Triage collection
    • IOC-driven investigation/remediation
    • Security visibility restoration road maps 

Preferred Qualifications:

• 4+ years acting in a similar capacity for a technology consulting firm 
• Performing broad IT assessments, audits, or due diligence 
• Bachelors degree

At RSM, we offer a competitive benefits and compensation package for all our people. Learn more about our total rewards at https://rsmus.com/careers/working-at-rsm/benefits.

We believe flexibility and in-person connection both play an important role in how we work and grow. Most roles at RSM follow a hybrid workstyle, which means team members are aligned to an RSM office and come together in person when it best supports clients, teams, development or relationship-building. Some roles may be virtual or primarily on-site based on role requirements, team priorities and client needs.

All applicants will receive consideration for employment as RSM does not tolerate discrimination and/or harassment based on race; color; creed; sincerely held religious beliefs, practices or observances; sex (including pregnancy or disabilities related to nursing); gender; sexual orientation; HIV Status; national origin; ancestry; familial or marital status; age; physical or mental disability; citizenship; political affiliation; medical condition (including family and medical leave); domestic violence victim status; past, current or prospective service in the US uniformed service; US Military/Veteran status; pre-disposing genetic characteristics or any other characteristic protected under applicable federal, state or local law. 

Accommodation for applicants with disabilities is available upon request in connection with the recruitment process and/or employment/partnership. RSM is committed to providing equal opportunity and reasonable accommodation for people with disabilities. If you require a reasonable accommodation to complete an application, interview, or otherwise participate in the recruiting process, please call us at 800-274-3978 or send us an email at careers@rsmus.com.

RSM does not intend to hire entry level candidates who will require sponsorship now OR in the future (i.e. F-1 visa holders). If you are a recent U.S. college / university graduate possessing 1-2 years of progressive and relevant work experience in a same or similar role to the one for which you are applying, excluding internships, you may be eligible for hire as an experienced associate.

RSM will consider for employment qualified applicants with arrest or conviction records. For those living in California or applying to a position in California, please click here for additional information.

At RSM, an employee’s pay at any point in their career is intended to reflect their experiences, performance, and skills for their current role. The salary range (or starting rate for interns and associates) for this role represents numerous factors considered in the hiring decisions including, but not limited to, education, skills, work experience, certifications, location, etc. As such, pay for the successful candidate(s) could fall anywhere within the stated range.