Cyber Forensics & Incident Response Associate

Charles River Associates; Oakland (CA); On-site; USD 100,000 - 127,000; Full time

Benefits offered by this job

Medical, dental and vision insurance

401(k) retirement plan with employer 0

Life and disability insurance

Paid time off

Paid parental leave

Wellness programs and EAP

Commuter benefits

Job summary

Charles River Associates (CRA) is a leading global consulting firm providing independent economic and financial analysis for litigation and strategic issues. We seek a Consulting Associate to perform hands-on digital forensics, lead collection and analysis, and drive containment in hybrid Microsoft environments.

The role involves rebuilding enterprise identity and infrastructure under time pressure, and clear client communications. Strong scripting and reporting abilities are essential.

Qualifications

• 3–5 years of hands-on experience in incident response, digital forensics, or a closely related security engineering role
• Demonstrated experience responding to ransomware, BEC, or intrusion matters in enterprise environments
• Deep working knowledge of Active Directory and Entra ID, including attack paths and hardening controls
• Proficiency with at least one enterprise EDR platform and its response tooling
• Excellent written communication; able to produce report-quality prose without heavy editing
• Ability to operate independently under incident conditions and manage competing priorities across concurrent matters

Responsibilities

• Execute digital forensic collection and analysis across Windows, Linux, virtualized and cloud environments
• Lead containment and remediation actions in ransomware matters
• Investigate business email compromise and wire fraud matters, including log analysis and auditing
• Analyze and remediate hybrid identity environments: Active Directory, Entra ID, Entra Connect, Conditional Access
• Develop tooling in PowerShell, Graph SDK, and Python for collection and recovery automation
• Produce clear forensic reports and timelines for clients
• Interface with client IT teams, counsel, and carrier representatives during active matters

Skills

Incident response

Digital forensics

Ransomware response

PowerShell scripting

Python scripting

Technical communication

Independent work

Education

Industry certifications: GCFA / GCIH / GNFA / GCFE / EnCE / CISSP

Tools

CrowdStrike Falcon

VMware vSAN

Google Workspace forensics tools

Job description

Charles River Associates (CRA) is a leading global consulting firm providing independent economic and financial analysis for litigation and strategic issues. We seek a Consulting Associate to perform hands-on digital forensics, lead collection and analysis, and drive containment in hybrid Microsoft environments.

The role involves rebuilding enterprise identity and infrastructure under time pressure, and clear client communications. Strong scripting and reporting abilities are essential.