Senior Associate/Recovery Services (Forensic Services practice)

Runs incident response and recovery matters from start to finish in the recovery services team of Charles River Associates' Forensic Services practice, owning each matter from intake to final report and directing consultant teams while a response is under way.

The senior associate runs several engagements at once, with responsibility for scope, budget, staffing and quality. They set priorities across containment, forensics, identity remediation and infrastructure recovery, build evidence-based effort estimates for fixed-price recovery work, and act as the main contact for client executives, outside counsel and insurance carriers. Final reports, executive briefings, insurance guidance memos and remediation roadmaps are theirs, as is quality review of consultants' work. The role coaches associates and consulting associates, helps standardise methodology and playbooks, and supports business development through law firm and carrier relationships and scoping calls for new matters.

CRA wants five to seven or more years in incident response, forensics or enterprise recovery, including at least three leading engagements or teams, a record of large ransomware recoveries or complex intrusions across thousands of endpoints, strong command of Active Directory and Entra ID, experience working under legal privilege with counsel and carriers, and the ability to price and deliver fixed-fee work. CISSP, GCFA or GCIH and prior IR consulting experience are preferred. Active incidents bring night and weekend work.