Senior Cyber Incident Response & Forensics Associate

Alvarez & Marsal; Boston (MA); On-site; USD 85,000 - 120,000; Full time

Job summary

Alvarez & Marsal is seeking a Senior Associate for Cyber Incident Response and Forensics Services. You will lead post-breach investigations, conduct deep-dive forensics, and work with client teams to contain incidents, determine root cause, and facilitate recovery across diverse environments.

You will balance hands-on analysis with client engagement, supporting proactive IR planning, tabletop exercises, and incident response retainers. Travel may be required as needed.

Qualifications

• Bachelor’s degree in computer science, cybersecurity, information systems, or a related field.
• Experience in incident response, digital forensics, or security operations; consulting or professional services is a plus.
• Active GIAC/SANS certifications in digital forensics or incident response are preferred.

Responsibilities

• Perform post-breach incident response and digital forensic investigations across Windows, Linux, and macOS.
• Support containment, eradication, and recovery activities with client teams.
• Investigate ransomware, business email compromise, and cloud account compromises.
• Conduct cloud forensics across AWS, Azure, and GCP and reconstruct attacker activity.
• Produce clear written reports and timelines for clients and regulators.
• Mentor junior analysts and contribute to playbooks and tooling.

Skills

Incident response

Digital forensics

Cloud forensics

Scripting (Python/PowerShell)

Threat hunting

Stakeholder communication

Mentorship

Education

Bachelor's degree in Computer Science / Cybersecurity

Tools

EnCase

FTK

Magnet AXIOM

X-Ways

Velociraptor

KAPE

Splunk

Job description

Alvarez & Marsal is seeking a Senior Associate for Cyber Incident Response and Forensics Services. You will lead post-breach investigations, conduct deep-dive forensics, and work with client teams to contain incidents, determine root cause, and facilitate recovery across diverse environments.

You will balance hands-on analysis with client engagement, supporting proactive IR planning, tabletop exercises, and incident response retainers. Travel may be required as needed.