Consulting Associate/Recovery Services (Forensic Services practice)

The role

The Consulting Associate is a technical responder and forensic analyst who executes incident response and recovery workstreams. You will lead forensic collection, drive containment and eradication in hybrid Microsoft environments, and rebuild enterprise identity and infrastructure.

What you will do

• Execute digital forensic collection and analysis across Windows, Linux, virtualized, and cloud environments
• Perform endpoint and identity containment using EDR platforms
• Lead technical recovery workstreams in ransomware matters
• Investigate business email compromise and wire fraud matters
• Analyze and remediate hybrid identity environments
• Develop and maintain PowerShell, Graph SDK, and Python tooling
• Produce forensic reports, investigation timelines, containment playbooks, and client status communications
• Support engagement scoping with technical level-of-effort estimates
• Interface with client IT teams, counsel, and carrier representatives

Required qualifications

• 3-5 years of hands-on experience in incident response, digital forensics, or a closely related security engineering role
• Demonstrated experience responding to ransomware, BEC, or intrusion matters in enterprise environments
• Deep working knowledge of Active Directory and Entra ID, including attack paths and hardening controls
• Proficiency with at least one enterprise EDR platform and its response tooling
• Strong scripting ability in PowerShell
• Excellent written communication

Nice to have

• Python
• Industry certifications such as GCFA, GCIH, GNFA, GCFE, EnCE, CISSP, or equivalent
• Experience with virtualization forensics and backup platform recovery
• Familiarity with Google Workspace forensics and administrative tooling
• Experience working under legal privilege with outside counsel and cyber insurance carriers
• Exposure to OT/ICS environments or regulated industries (healthcare, financial services)

Benefits

• 100 hours of training annually
• Technical training, presentation skills, internal seminars, and career mentoring
• Superior benefits package
• Wellness programming
• In-house immigration support for foreign nationals and international business travelers
• Extended medical, dental, and vision insurance
• ERP with employer contribution
• TFSP
• RESP
• Life and disability insurance
• Paid time off (vacation, sick leave, holidays)
• Paid parental leave

Before you apply

• To be considered for a position in Canada, include resume with current address, personal email and telephone number

About the company

Charles River Associates is a leading global consulting firm that provides economic, financial, and business management expertise to major law firms, corporations and governments around the world.