Forensic Cyber Recovery Associate

Charles River Associates; United States; Hybrid; USD 100.000 - 127.000; Vollzeit

Zusammenfassung

Charles River Associates is seeking a Consulting Associate for its Forensic Services practice in the United States. The role involves hands-on incident response, digital forensics, and recovery in hybrid Microsoft environments, requiring strong technical and communication skills.

You will lead forensic collection/analysis, contain threats, rebuild identity infrastructure, and interface with clients under time pressure.

Qualifikationen

• 3–5 years of hands-on experience in incident response, digital forensics, or a closely related security engineering role.
• Demonstrated experience responding to ransomware, BEC, or intrusion matters in enterprise environments.
• Deep working knowledge of Active Directory and Entra ID, including attack paths and hardening controls.
• Proficiency with at least one enterprise EDR platform and its response tooling.
• Strong scripting ability in PowerShell; Python a plus.
• Excellent written communication; able to produce report-quality prose without heavy editing.
• Ability to operate independently under incident conditions and manage competing priorities across concurrent matters.

Aufgaben

• Execute digital forensic collection and analysis across Windows, Linux, virtualization, and cloud environments.
• Perform endpoint and identity containment using EDR platforms with real-time response and telemetry analysis.
• Lead technical recovery workstreams in ransomware matters including domain controller rebuilds and credential resets.
• Investigate business email compromise and wire fraud matters with mail flow reconstruction and tenant log analysis.
• Analyze and remediate hybrid identity environments: Active Directory, Entra ID, Entra Connect, Conditional Access.
• Develop and maintain PowerShell, Graph SDK, and Python tooling for collection, containment, and recovery automation.
• Produce clear, defensible written work products: forensic reports, timelines, containment playbooks, client communications.
• Support engagement scoping with technical level-of-effort estimates grounded in evidence.

Kenntnisse

Incident response

Digital forensics

PowerShell

Python

Written communication

Independent work

Tools

CrowdStrike Falcon

Jobbeschreibung

Charles River Associates is seeking a Consulting Associate for its Forensic Services practice in the United States. The role involves hands-on incident response, digital forensics, and recovery in hybrid Microsoft environments, requiring strong technical and communication skills.

You will lead forensic collection/analysis, contain threats, rebuild identity infrastructure, and interface with clients under time pressure.