Forensic Incident Response Associate — Recovery Services

Charles River Associates; Chicago (IL); Hybrid; USD 100,000 - 127,000; Full time

Job summary

Charles River Associates is seeking a Consulting Associate in its Forensic Services to execute core incident response and digital forensics tasks within a dynamic team. You will lead forensic collection and analysis across Windows, Linux, VMware, and cloud environments, delivering timely insights under pressure.

You will guide containment, eradication, and recovery efforts in ransomware matters, coordinating with client IT teams, counsel, and carriers.

Qualifications

• 3–5 years of hands-on incident response or digital forensics experience.
• Experience handling ransomware, BEC, or intrusion matters in enterprise environments.
• Deep knowledge of Active Directory and Entra ID, with hardening concepts.
• Proficiency with at least one enterprise EDR and its response tooling.
• Strong PowerShell skills; Python is a plus; excellent written communication.

Responsibilities

• Execute digital forensic collection and analysis across Windows, Linux, VMware, and cloud.
• Containment and eradication actions using EDR and real-time response.
• Lead recovery workstreams in ransomware engagements and restore domains.
• Interface with client IT teams, counsel, and carriers; produce clear reports.
• Develop tooling in PowerShell, Graph SDK, and Python to automate collection and recovery.

Skills

Incident response

Digital forensics

Scripting: PowerShell

Python

Communication

Independent work

Education

GCFA

GCIH

GNFA

GCFE

EnCE

CISSP

Tools

CrowdStrike Falcon

Active Directory

Entra ID

Azure

VMware

Google Workspace forensics

Job description

Charles River Associates is seeking a Consulting Associate in its Forensic Services to execute core incident response and digital forensics tasks within a dynamic team. You will lead forensic collection and analysis across Windows, Linux, VMware, and cloud environments, delivering timely insights under pressure.

You will guide containment, eradication, and recovery efforts in ransomware matters, coordinating with client IT teams, counsel, and carriers.