Forensic Incident Response Associate

Charles River Associates; New York (NY); Hybrid; USD 100,000 - 127,000; Full time

Benefits offered by this job

Medical, dental, vision insurance

401(k) with employer match

Paid time off

Parental leave

Wellness programs

Commuter benefits

Job summary

Charles River Associates seeks a hands-on Consulting Associate to drive forensic collection and analysis in hybrid Microsoft environments. You will lead containment and eradication actions, rebuild enterprise identity, and support advisory teams under tight deadlines.

The role requires 3–5 years in incident response or forensics, strong scripting in PowerShell, and experience with EDR platforms. Flexible hybrid work and cross‑functional collaboration are offered.

Qualifications

• 3-5 years of hands-on incident response or digital forensics experience.
• Experience responding to ransomware, BEC, or intrusion matters in enterprise environments.
• Deep working knowledge of Active Directory and Entra ID; attack paths and hardening controls.
• Proficiency with at least one enterprise EDR platform and its response tooling.
• Scripting ability in PowerShell; Python is a plus.
• Excellent written communication; able to produce report-quality prose without heavy editing.
• Ability to operate independently under incident conditions and manage competing priorities across concurrent matters.

Responsibilities

• Execute digital forensic collection and analysis across Windows, Linux, VMware, and cloud environments.
• Lead technical recovery workstreams in ransomware matters and perform containment actions.
• Investigate business email compromise and wire fraud, including tenant log analysis and attacker infrastructure attribution.
• Analyze and remediate hybrid identity environments: Active Directory and Entra ID configurations.
• Develop tooling in PowerShell, Python, and Graph SDK for collection, containment, and recovery automation.
• Produce clear, defensible forensic reports, timelines, and client communications.
• Interface with client IT teams, counsel, and carrier representatives during active matters.

Skills

Incident response

Digital forensics

Ransomware response

Active Directory

Entra ID

EDR tooling

PowerShell

Python

Communication skills

Education

GCFA

GCIH

GNFA

GCFE

EnCE

CISSP

Tools

CrowdStrike Falcon

VMware

Azure

M365

Google Workspace

Job description

Charles River Associates seeks a hands-on Consulting Associate to drive forensic collection and analysis in hybrid Microsoft environments. You will lead containment and eradication actions, rebuild enterprise identity, and support advisory teams under tight deadlines.

The role requires 3–5 years in incident response or forensics, strong scripting in PowerShell, and experience with EDR platforms. Flexible hybrid work and cross‑functional collaboration are offered.