Senior Cyber Incident Response Lead

Charles River Associates; Oakland (CA); Hybrid; USD 130,000 - 153,000; Full time

Benefits offered by this job

Medical insurance

Dental insurance

Vision insurance

401(k) plan

Life insurance

Disability insurance

Paid time off

Parental leave

Wellness program

Commuter benefits

Immigration support

Job summary

Charles River Associates (CRA) in Oakland seeks a Senior Associate to lead incident response, forensics, and recovery engagements end to end, overseeing scoping, staffing, and delivery. You will direct technical workstreams and serve as the primary contact for executives, counsel, and carriers.

The role requires 5-7+ years in cybersecurity incident response and strong knowledge of hybrid identity architectures; executive communication skills are essential for briefing boards and CISOs.

Qualifications

• 5-7+ years in cybersecurity incident response, digital forensics, or enterprise recovery.
• 3+ years leading engagements or teams.
• Proven track record leading large ransomware recovery or complex intrusion matters in enterprise environments.
• Strong command of hybrid Microsoft identity architecture (Active Directory, Entra ID, Conditional Access, privileged access models).
• Experience working under legal privilege and managing the counsel and carrier dynamics of breach response.
• Demonstrated ability to scope and price engagements accurately, and to manage delivery to fixed-price commitments.
• Executive-grade written and verbal communication; comfortable briefing boards, GCs, and CISOs.

Responsibilities

• Lead multiple incident response, forensic investigation, and recovery engagements.
• Direct technical workstreams across containment, forensics, identity remediation, and infrastructure recovery.
• Develop evidence-based scoping and level-of-effort models for fixed-price recovery engagements.
• Serve as primary point of contact for client executives, outside counsel, and insurance carrier representatives.
• Own final written work product: investigation reports, executive briefings, insurance guidance memoranda, and remediation roadmaps.
• Review and quality-control consultant deliverables for technical accuracy and defensibility.
• Mentor and develop consulting associates and associates, including structured feedback and engagement-level coaching.
• Contribute to practice development: methodology and playbook standardization, reusable engagement IP, service line definition, and thought leadership.
• Support business development through carrier and law firm relationship management, proposal development, and scoping calls for inbound matters.

Skills

Incident response

Cybersecurity

Forensics

Leadership

Executive communication

Client management

Tools

Active Directory

Entra ID

Job description

Charles River Associates (CRA) in Oakland seeks a Senior Associate to lead incident response, forensics, and recovery engagements end to end, overseeing scoping, staffing, and delivery. You will direct technical workstreams and serve as the primary contact for executives, counsel, and carriers.

The role requires 5-7+ years in cybersecurity incident response and strong knowledge of hybrid identity architectures; executive communication skills are essential for briefing boards and CISOs.