Forensic Incident Response Associate (Recovery Services)

Charles River Associates; Boston (MA); On-site; USD 100,000 - 127,000; Full time

Job summary

Charles River Associates (CRA) is seeking a Consulting Associate in its Forensic Services practice to execute incident response and digital forensics engagements. You will lead collection and analysis across Windows, Linux, virtualized and cloud environments, and drive containment under time pressure.

The role requires hands-on experience with ransomware, BEC, or intrusion matters, strong scripting (PowerShell; Python a plus), and the ability to communicate findings clearly to counsel and

Qualifications

• 3–5 years of hands-on experience in incident response, digital forensics, or a closely related security engineering role
• Demonstrated experience responding to ransomware, BEC, or intrusion matters in enterprise environments
• Deep working knowledge of Active Directory and Entra ID, including attack paths and hardening controls
• Proficiency with at least one enterprise EDR platform and its response tooling
• Strong scripting ability in PowerShell; Python a plus
• Excellent written communication; able to produce report‑quality prose without heavy editing
• Ability to operate independently under incident conditions and manage competing priorities across concurrent matters

Responsibilities

• Execute digital forensic collection and analysis across Windows, Linux, virtualized (VMware, Hyper‑V), and cloud environments
• Perform endpoint and identity containment using EDR platforms, including real‑time response, custom detection logic, and telemetry analysis
• Lead technical recovery workstreams in ransomware matters: domain controller rebuild and validation, tiered credential resets, hypervisor and backup restoration
• Investigate business email compromise and wire fraud matters, including mail flow reconstruction, tenant log analysis, OAuth audits
• Analyze and remediate hybrid identity environments: Active Directory, Entra ID, Entra Connect, Conditional Access
• Develop and maintain PowerShell, Graph SDK, and Python tooling for collection, containment, and recovery automation
• Produce clear, defensible written work product: forensic reports, timelines, playbooks, client communications
• Support engagement scoping with technical level‑of‑effort estimates grounded in evidence
• Interface directly with client IT teams, counsel, and carrier representatives during active matters

Skills

Incident response

Digital forensics

Ransomware response

BEC response

Active Directory

Entra ID

EDR tooling

PowerShell

Python

Written communication

Independent work

Tools

CrowdStrike Falcon

VMware

Hyper-V

Azure

M365

Google Workspace

Job description

Charles River Associates (CRA) is seeking a Consulting Associate in its Forensic Services practice to execute incident response and digital forensics engagements. You will lead collection and analysis across Windows, Linux, virtualized and cloud environments, and drive containment under time pressure.

The role requires hands-on experience with ransomware, BEC, or intrusion matters, strong scripting (PowerShell; Python a plus), and the ability to communicate findings clearly to counsel and