Cyber Forensics & Incident Response Associate

Charles River Associates; Houston (TX); Hybrid; USD 100,000 - 127,000; Full time

Benefits offered by this job

100 hours of training annually

Comprehensive benefits package

Immigration support

Job summary

Charles River Associates seeks a Consulting Associate for its Forensic Services to execute incident response and digital forensics across Windows, Linux, VMware, and cloud environments. You will lead containment actions, perform credential resets, and guide recovery workflows under time pressure, often at night or weekends during engagements.

The role requires 3–5 years of hands‑on IR/forensics experience, strong scripting in PowerShell and Python, and excellent written communication.

Qualifications

• 3-5 years hands‑on incident response or digital forensics experience.
• Experience responding to ransomware, BEC, or intrusions in enterprise environments.
• Deep knowledge of AD/Entra ID, Kerberos, and hardening controls.
• Proficiency with at least one enterprise EDR and its tooling.

Responsibilities

• Execute forensic collection and analysis across Windows, Linux, virtualization, and cloud environments.
• Lead containment and eradication actions in hybrid Microsoft environments.
• Coordinate recovery workstreams including domain controller rebuilds and credential resets.
• Interface with clients and counsel during active engagements.

Skills

Incident response

Digital forensics

Ransomware

PowerShell

Python

Written communication

Independent work

Education

Bachelor’s degree in a relevant field

Tools

EDR platform (CrowdStrike Falcon)

Active Directory/Entra ID

VMware/Hyper‑V virtualization

Azure/M365/Google Workspace

PowerShell scripting

Job description

Charles River Associates seeks a Consulting Associate for its Forensic Services to execute incident response and digital forensics across Windows, Linux, VMware, and cloud environments. You will lead containment actions, perform credential resets, and guide recovery workflows under time pressure, often at night or weekends during engagements.

The role requires 3–5 years of hands‑on IR/forensics experience, strong scripting in PowerShell and Python, and excellent written communication.