Cyber Response & Remediation Delivery Lead

Get roles like this by email

New roles in Waterloo Region, mailed the morning after they appear, and The Weekly each Monday.

Change or stop it from any email.

We are the leading provider of professional services to the middle market globally, our purpose is to instill confidence in a world of change, empowering our clients and people to realize their full potential. Our exceptional people are the key to our unrivaled, culture and talent experience and our ability to be compelling to our clients. You’ll find an environment that inspires and empowers you to thrive both personally and professionally. There’s no one like you and that’s why there’s nowhere like RSM.

Position Summary

The Remediation Delivery Lead is responsible for leading the technical remediation, containment, and recovery workstreams associated with complex cybersecurity incidents. This individual serves as a key delivery leader within the Cyber Response practice, coordinating technical teams, client stakeholders, incident leadership, and forensic resources to move an affected environment from active response through stabilization and recovery.

The ideal candidate combines strong technical infrastructure and cybersecurity experience with the ability to lead teams and communicate effectively during high-pressure incidents. This role requires someone who can quickly understand a client's environment, identify and prioritize remediation objectives, develop an actionable remediation strategy, coordinate execution across multiple technical workstreams, and clearly communicate progress, risks, dependencies, and decisions to both technical and executive stakeholders.

Key Responsibilities

• * Lead remediation, containment, hardening, and recovery activities during cybersecurity incident response engagements.

  • Develop and manage remediation plans based on incident scope, business priorities, known compromise, forensic findings, and operational dependencies.

  • Coordinate closely with Incident Command, Digital Forensics and Incident Response (DFIR), client IT/security teams, and other stakeholders throughout the engagement.

  • Translate forensic findings and indicators of compromise into actionable containment and remediation activities.

  • Prioritize multiple concurrent technical workstreams and maintain clear ownership, sequencing, dependencies, and status.

  • Guide clients through containment decisions while balancing security objectives, business continuity, evidence preservation, and operational impact.

  • Lead technical and executive-level discussions regarding remediation strategy, recovery priorities, risks, blockers, and overall engagement status.

  • Coordinate infrastructure recovery and security-hardening activities across identity, endpoint, virtualization, network, cloud, and backup environments.

  • Ensure appropriate change control, client authorization, documentation, rollback planning, and coordination with forensic teams before potentially impactful changes are made. This aligns directly with the change-control requirements in the remediation playbooks.

  • Maintain accurate remediation tracking and ensure actions, owners, outcomes, and outstanding risks are clearly communicated.

  • Provide technical leadership and guidance to remediation engineers while remaining capable of engaging directly in complex technical troubleshooting when necessary.

  • Support the continued development of Cyber Response remediation methodologies, playbooks, tooling, and delivery standards.

Technical Experience

Candidates should have strong hands-on or delivery experience across several of the following areas:

• * Active Directory and identity security

  • Active Directory recovery and hardening

  • Privileged account remediation

  • Authentication and identity dependencies

  • Microsoft Entra ID

  • Microsoft 365 identity and security

  • Cloud and collaboration platforms

    • Microsoft 365

    • Microsoft Entra ID

    • Google Workspace

  • Virtualization and infrastructure

    • VMware vSphere / ESXi

    • Microsoft Hyper-V

    • Windows Server environments

    • Core enterprise infrastructure and network services

  • Backup and recovery

    • Veeam Backup & Replication

    • Enterprise backup technologies

    • Backup validation and recovery planning

    • Recovery of critical infrastructure following destructive incidents

  • Endpoint security and incident response

    • EDR deployment and management

    • Endpoint containment

    • Triage collection

    • IOC-driven investigation/remediation

    • Security visibility restoration road maps

Preferred Qualifications:

• 4+ years acting in a similar capacity for a technology consulting firm

• Performing broad IT assessments, audits, or due diligence

• Bachelors degree

At RSM, we offer a competitive benefits and compensation package for all our people. Learn more about our total rewards at <https://rsmus.com/careers/working-at-rsm/benefits>.

We believe flexibility and in-person connection both play an important role in how we work and grow. Most roles at RSM follow a hybrid workstyle, which means team members are aligned to an RSM office and come together in person when it best supports clients, teams, development or relationship-building. Some roles may be virtual or primarily on-site based on role requirements, team priorities and client needs.

All applicants will receive consideration for employment as RSM does not tolerate discrimination and/or harassment based on race; color; creed; sincerely held religious beliefs, practices or observances; sex (including pregnancy or disabilities related to nursing); gender; sexual orientation; HIV Status; national origin; ancestry; familial or marital status; age; physical or mental disability; citizenship; political affiliation; medical condition (including family and medical leave); domestic violence victim status; past, current or prospective service in the US uniformed service; US Military/Veteran status; pre-disposing genetic characteristics or any other characteristic protected under applicable federal, state…