Senior Digital Forensics & Cyber Investigations Lead

Charles River Associates International; Oakland (CA); Hybrid; USD 140,000 - 170,000; Full time

Benefits offered by this job

Training programs

Wellness program

Immigration support

Job summary

Charles River Associates seeks an Associate Principal to lead forensic investigations and oversee multidisciplinary teams across Apple, Windows and Linux ecosystems. The role emphasizes hands-on analysis, data recovery, and secure data handling within complex engagements for clients and counsel.

The position requires deep MacOS forensics knowledge, strong leadership and client-facing skills, and readiness to travel for client projects. CRA offers extensive training and a broad benefits package.

Qualifications

• Bachelor’s or Master’s in a related field preferred but can be waived with experience.
• 7–10+ years in cyber intrusion investigation, digital forensics or incident response analysis.
• Training or certifications in MacOS forensic artifacts (plists, unified logs, FS Events, Spotlight metadata).
• Deep knowledge of MacOS, Windows and Linux OS and file systems (APFS, HFS+, FAT, NTFS).
• Experience with forensic software and leading data analytics engagements.

Responsibilities

• Leading digital forensic investigations for CRA clients and preparing responses to theft of trade secret situations.
• Leading teams or assigning resources for onsite data collection and triage across multiple devices.
• Performing forensic analysis of MacOS artifacts and other file systems for investigations.
• User data remediation and secure data removal across file systems and platforms.
• Providing expert witness testimony and serving as primary client contact for engagements.
• Supervising project delivery, QA, and identifying improvement opportunities for the forensic team.
• Collaborating with law enforcement and recruiting/training team members as needed.

Skills

Leadership

Team management

Client communication

Mentoring/Training

Travel readiness

Education

Bachelor's/Master's in related field

7-10+ years in cyber intrusion/digital forensics

MacOS forensic artifacts training

Tools

MacOS forensics tools

APFS/HFS+/NTFS knowledge

Forensic software (open-source/commercial)

Data collection tools

Job description

Charles River Associates seeks an Associate Principal to lead forensic investigations and oversee multidisciplinary teams across Apple, Windows and Linux ecosystems. The role emphasizes hands-on analysis, data recovery, and secure data handling within complex engagements for clients and counsel.

The position requires deep MacOS forensics knowledge, strong leadership and client-facing skills, and readiness to travel for client projects. CRA offers extensive training and a broad benefits package.