Digital Forensics & Incident Response Associate

Charles River Associates; Washington (District of Columbia); Hybrid; USD 100,000 - 127,000; Full time

Benefits offered by this job

401(k) retirement plan with employer–m

Medical, dental, and vision insurance

Paid time off and holidays

Job summary

Charles River Associates (CRA) is seeking a Consulting Associate for its Forensic Services practice in the Washington, DC area to lead incident response and digital forensics engagements. You will work across Windows, Linux, VMware, Azure, and cloud environments, building containment and recovery playbooks while communicating findings to clients and counsel.

CRA offers growth, training, and a collaborative, high-stakes environment with opportunities to collaborate with counsel and clients during

Qualifications

• 3–5 years of hands-on incident response, digital forensics, or security engineering experience.
• Experience responding to ransomware, BEC, or intrusion matters in enterprise environments.
• Deep knowledge of Active Directory and Entra ID, including attack paths and hardening controls.
• Proficiency with at least one enterprise EDR platform and its response tooling.
• Strong scripting ability in PowerShell; Python a plus.
• Excellent written communication; able to produce report-quality prose without heavy editing.
• Ability to operate independently under incident conditions and manage competing priorities across concurrent matters.

Responsibilities

• Execute digital forensic collection and analysis across Windows, Linux, virtualized (VMware, Hyper‑V), and cloud (Azure, M365, Google Workspace) environments.
• Perform endpoint and identity containment using EDR platforms, including real‑time response, custom detection logic, and telemetry analysis.
• Lead technical recovery workstreams in ransomware matters: domain controller rebuild and validation, credential resets, hypervisor and backup restoration, and host checkout against gate criteria.
• Investigate business email compromise and wire fraud matters, including mail flow reconstruction and tenant log analysis.
• Analyze and remediate hybrid identity environments: Active Directory, Entra ID, Entra Connect, CA, and privileged access configurations.
• Develop and maintain PowerShell, Graph SDK, and Python tooling for collection, containment, and recovery automation.
• Produce clear, defensible written work product: forensic reports, timelines, containment playbooks, and client communications.
• Support engagement scoping by contributing technical level-of-effort estimates grounded in environment evidence.
• Interface directly with client IT teams, counsel, and carrier representatives during active matters.

Skills

Incident response

Digital forensics

Security engineering

PowerShell

Python

EDR tooling

Active Directory

Entra ID

Education

GCFA

GCIH

GNFA

GCFE

EnCE

CISSP

Tools

VMware

Hyper-V

Azure

M365

Google Workspace

CrowdStrike Falcon

Job description

Charles River Associates (CRA) is seeking a Consulting Associate for its Forensic Services practice in the Washington, DC area to lead incident response and digital forensics engagements. You will work across Windows, Linux, VMware, Azure, and cloud environments, building containment and recovery playbooks while communicating findings to clients and counsel.

CRA offers growth, training, and a collaborative, high-stakes environment with opportunities to collaborate with counsel and clients during