Senior Forensic Recovery Lead – Incident Response

Charles River Associates; United States; Remote; USD 130,000 - 153,000; Full time

Benefits offered by this job

Wellness program

Immigration support

Comprehensive benefits

Job summary

Charles River Associates is seeking a Senior Associate in its Forensic Services practice to lead incident response and recovery engagements end to end, with direct responsibility for scope, budgeting, staffing, and delivering high-quality outcomes. You will coordinate with executives, counsel, and carriers while advancing reusable methodologies and IP.

Candidates should have 5–7+ years in cybersecurity incident response or digital forensics, and strong leadership and communication skills.

Qualifications

• Bachelor's degree (Master's preferred) in Cybersecurity, CS&E, Digital Forensics or related field.
• 5-7+ years in cybersecurity incident response, digital forensics or enterprise recovery.
• Certifications such as CISSP, GCFA, GCIH, CISM, or equivalent; advanced degree a plus.
• Track record leading large ransomware recovery or complex intrusions in enterprise settings.
• Strong command of hybrid Microsoft identity architecture in AD/Entra ID and access models.
• Experience handling legal privilege and coordination with counsel and carriers.

Responsibilities

• Lead multiple concurrent incident response, forensics and recovery engagements with end-to-end ownership.
• Direct technical workstreams across containment, forensics, identity remediation and recovery.
• Develop scoping and LOE models for fixed-price engagements prioritized by business needs.
• Be primary client contact for executives, outside counsel and insurance carriers.
• Own final written work: investigation reports, executive briefings, and remediation roadmaps.
• Quality-control consultant deliverables for technical accuracy and defensibility.
• Mentor associates and contribute to practice development and playbooks.
• Support business development with carriers and law firms.

Skills

Cybersecurity incident response

Digital forensics

Executive communication

Team leadership

Education

Bachelor's degree

Master's preferred

Job description

Charles River Associates is seeking a Senior Associate in its Forensic Services practice to lead incident response and recovery engagements end to end, with direct responsibility for scope, budgeting, staffing, and delivering high-quality outcomes. You will coordinate with executives, counsel, and carriers while advancing reusable methodologies and IP.

Candidates should have 5–7+ years in cybersecurity incident response or digital forensics, and strong leadership and communication skills.