Senior Cyber Incident Response Lead

Charles River Associates; Washington (District of Columbia); Hybrid; USD 130,000 - 153,000; Full time

Job summary

Charles River Associates in Washington, DC seeks a Senior Associate for the Forensic Services practice to lead incident response, recovery engagements, and client communications from intake to final report. You will direct cross-functional teams, manage budgets, and ensure quality across deliverables.

The role requires 5-7+ years in cybersecurity incident response or forensics, including large ransomware recoveries, and strong command of Microsoft identity architecture.

Qualifications

• 5-7+ years in cybersecurity incident response, digital forensics, or enterprise recovery; 3+ years leading engagements or teams.
• Track record leading large ransomware recovery or complex intrusion matters in enterprise environments.

Responsibilities

• Lead multiple incident response, forensic investigation, and recovery engagements, owning scope, budget, staffing, and delivery quality.
• Direct technical workstreams across containment, forensics, identity remediation, and infrastructure recovery.
• Develop evidence-based scoping and level-of-effort models for fixed-price recovery engagements.
• Serve as primary contact for client executives, outside counsel, and insurance carrier representatives.
• Own final written work product: investigation reports and remediation roadmaps.
• Mentor and develop associates and participate in practice development and thought leadership.

Skills

Incident response

Digital forensics

Enterprise recovery

Team leadership

Executive communication

Tools

Active Directory

Entra ID

Conditional Access

Job description

Charles River Associates in Washington, DC seeks a Senior Associate for the Forensic Services practice to lead incident response, recovery engagements, and client communications from intake to final report. You will direct cross-functional teams, manage budgets, and ensure quality across deliverables.

The role requires 5-7+ years in cybersecurity incident response or forensics, including large ransomware recoveries, and strong command of Microsoft identity architecture.