Senior Cyber Forensics & Incident Response Lead

Charles River Associates; Chicago (IL); Hybrid; USD 130,000 - 153,000; Full time

Job summary

Charles River Associates (CRA) in Chicago seeks a Senior Associate for its Forensic Services practice to lead end-to-end incident response and recovery engagements, directing teams and managing client and counsel relationships. You will own matters from intake through final report, delivering credible findings to executives, boards, and carriers.

This role requires 5-7+ years in cybersecurity incident response, digital forensics, or enterprise recovery, including leadership experience.

Qualifications

• 5-7+ years in cybersecurity incident response, digital forensics, or enterprise recovery.
• 3+ years leading engagements or teams.
• Proven track record leading ransomware recovery or complex intrusion matters.
• Strong command of hybrid Microsoft identity architecture to direct and validate work.
• Experience working under legal privilege with counsel and carriers.
• Executive-level written and verbal communication; comfortable briefing boards and CISOs.

Responsibilities

• Lead multiple incident response, forensic investigation, and recovery engagements, owning scope, budget, staffing, and delivery quality.
• Direct technical workstreams across containment, forensics, identity remediation, and infrastructure recovery.
• Develop evidence-based scoping and level-of-effort models for fixed-price recovery engagements.
• Serve as primary point of contact for client executives, outside counsel, and insurance carrier representatives.
• Own final written reports: investigation reports, executive briefings, and remediation roadmaps.
• Review and quality-control consultant deliverables for technical accuracy and defensibility.
• Mentor and develop consulting associates, including coaching and feedback.
• Contribute to practice development: methodology, playbooks, and engagement IP.

Skills

Incident response

Digital forensics

Enterprise recovery

Leadership

Ransomware recovery

Identity architecture

Legal privilege experience

Pricing engagements

Executive communication

Education

CISSP

GCFA

GCIH

CISM

Advanced degree

Job description

Charles River Associates (CRA) in Chicago seeks a Senior Associate for its Forensic Services practice to lead end-to-end incident response and recovery engagements, directing teams and managing client and counsel relationships. You will own matters from intake through final report, delivering credible findings to executives, boards, and carriers.

This role requires 5-7+ years in cybersecurity incident response, digital forensics, or enterprise recovery, including leadership experience.