Hybrid Digital Forensics & Incident Response Associate

Charles River Associates; Dallas (TX); Hybrid; USD 100,000 - 127,000; Full time

Benefits offered by this job

Comprehensive benefits package

Wellness program

Immigration support

Commuter benefits

Job summary

Charles River Associates in the United States is seeking a Consulting Associate to join our Forensic Services practice. You will lead incident response, digital forensics, and recovery engagements, coordinating with client teams and counsel under time pressure.

The role emphasizes hands‑on collection, containment, and analysis across Windows, Linux, virtualized environments (VMware/Hyper‑V), and cloud platforms, with opportunities to develop automation tooling in PowerShell and Python.

Qualifications

• 3-5 years of hands-on incident response or digital forensics.
• Experience responding to ransomware, BEC, or intrusions in enterprise environments.
• Deep working knowledge of Active Directory and Entra ID and hardening controls.
• Proficiency with at least one enterprise EDR platform and its tooling.
• Strong scripting ability in PowerShell; Python is a plus.
• Excellent written communication; capable of producing report-ready prose.

Responsibilities

• Execute digital forensic collection and analysis across Windows, Linux, virtualized and cloud environments.
• Lead containment and remediation actions in ransomware matters; rebuilds and credential resets.
• Interface with client IT teams, counsel, and carriers during active engagements.
• Develop and maintain automation tooling for collection, containment, and recovery.

Skills

Incident response

Digital forensics

Ransomware response

Active Directory/Entra ID

EDR tooling

PowerShell scripting

Python

Written communication

Tools

CrowdStrike Falcon

Job description

Charles River Associates in the United States is seeking a Consulting Associate to join our Forensic Services practice. You will lead incident response, digital forensics, and recovery engagements, coordinating with client teams and counsel under time pressure.

The role emphasizes hands‑on collection, containment, and analysis across Windows, Linux, virtualized environments (VMware/Hyper‑V), and cloud platforms, with opportunities to develop automation tooling in PowerShell and Python.