Consulting Associate/Recovery Services (Forensic Services practice)
Charles River Associates · Boston, MA, United States; Chicago, IL, United States; Dallas, Texas, United States; Houston, Texas, United States; New York, NY, United States; Oakland, CA, Un
About the role
A hands-on incident responder and forensic analyst in Charles River Associates' Forensic Services practice, carrying out the technical work of response and recovery engagements, particularly ransomware and business email compromise.
The associate collects and analyses evidence across Windows, Linux, VMware, Hyper-V and Microsoft 365 or Google Workspace, contains threats with CrowdStrike or similar EDR, rebuilds domain controllers and resets credentials during ransomware recovery, reconstructs mail flow in BEC cases, and repairs hybrid AD and Entra ID setups. CRA wants three to five years in incident response or forensics, real ransomware or intrusion cases, deep AD and Entra ID attack knowledge, EDR proficiency and strong PowerShell. Nights and weekends come with active incidents.