Senior Cyber Incident Response & Forensics Specialist

Alvarez & Marsal; Washington (District of Columbia); On-site; USD 85,000 - 120,000; Full time

Job summary

Alvarez & Marsal in Washington, DC seeks a Senior Associate in Global Cyber Risk Services to lead incident response and forensics engagements. You will work with clients across industries, conducting investigations, guiding containment, and delivering clear written reports to executives and boards.

The role emphasizes hands-on analysis, collaboration with client teams, and ongoing development of playbooks and tooling in a fast-evolving cyber landscape.

Qualifications

• 3–6 years of incident response or digital forensics experience.
• Active GIAC/SANS certs; GCFE or GCIH required.
• Hands-on host-based forensics on Windows, Linux, and macOS.
• Experience with ransomware, BEC, or cloud account compromises.
• Forensic tooling and SIEM/EDR knowledge.
• Scripting for automation (Python/PowerShell/Bash).
• Understanding MITRE ATT&CK framework.
• Willing to travel and occasional weekend work.
• Strong written/verbal communication; ability to present to Boards.
• Ability to create technical documentation.

Responsibilities

• Perform post-breach incident response and digital forensic investigations.
• Assist containment, eradication, and recovery activities with client teams.
• Investigate ransomware and BEC across SaaS and cloud.
• Perform cloud forensics across AWS, Azure, and GCP.
• Analyze memory, disk, network, and logs with tooling.
• Prepare clear reports and timelines for stakeholders.
• Develop playbooks and contribute to tooling.

Skills

Incident response

Digital forensics

Scripting (Python)

MITRE ATT&CK

Communication skills

Travel ready

Client engagement

Education

Bachelor's degree in CS or related

Equivalent experience

Tools

EnCase

FTK

Magnet AXIOM

X-Ways

Velociraptor

KAPE

Volatility

F-Response

SIFT

Splunk

EDR platforms

Job description

Alvarez & Marsal in Washington, DC seeks a Senior Associate in Global Cyber Risk Services to lead incident response and forensics engagements. You will work with clients across industries, conducting investigations, guiding containment, and delivering clear written reports to executives and boards.

The role emphasizes hands-on analysis, collaboration with client teams, and ongoing development of playbooks and tooling in a fast-evolving cyber landscape.