# Consulting Associate/Recovery Services (Forensic Services practice)

**Company**: Charles River Associates
**Location**: Boston, MA, United States; Chicago, IL, United States; Dallas, Texas, United States; Houston, Texas, United States; New York, NY, United States; Oakland, CA, United States; Washington, DC, United States
**Work arrangement**: hybrid
**Experience**: mid
**Job type**: full-time
**Salary**: $100,000 - $126,500
**Category**: Consulting
**Industry**: Consulting

**Apply**: https://job-boards.greenhouse.io/charlesriverassociates/jobs/8130646?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply
**Canonical**: https://yubhub.co/jobs/job_b21b35fd-613

## Description

Charles River Associates (CRA) is a global consulting firm that provides economic and financial analysis.

The Consulting Associate role in CRA's Forensic Services practice supports companies' commitment to integrity by assisting them and their counsel in independently responding to allegations of fraud, waste, abuse, misconduct, and non-compliance.

Key Responsibilities:

- Execute digital forensic collection and analysis across various environments

- Perform endpoint and identity containment using EDR platforms

- Lead technical recovery workstreams in ransomware matters

- Investigate business email compromise and wire fraud matters

- Analyze and remediate hybrid identity environments

- Develop and maintain PowerShell, Graph SDK, and Python tooling

- Produce clear, defensible written work product

- Support engagement scoping and interface with client IT teams, counsel, and carrier representatives

Desired Qualifications:

- 3-5 years of hands-on experience in incident response, digital forensics, or a closely related security engineering role

- Demonstrated experience responding to ransomware, BEC, or intrusion matters

- Deep working knowledge of Active Directory and Entra ID

- Proficiency with at least one enterprise EDR platform

- Strong scripting ability in PowerShell; Python a plus

- Excellent written communication

Preferred Qualifications:

- Industry certifications such as GCFA, GCIH, GNFA, GCFE, EnCE, CISSP, or equivalent

- Experience with virtualization forensics and backup platform recovery

- Familiarity with Google Workspace forensics and administrative tooling

- Experience working under legal privilege

- Exposure to OT/ICS environments or regulated industries

Work Environment:

- Incident response work involves surge periods, including nights and weekends during active engagements

Career Growth and Benefits:

- CRA's robust skills development programs

- Comprehensive total rewards program

- Wellness programming and employee assistance resources

- In-house immigration support for foreign nationals and international business travelers

Salary and other compensation:

- A good-faith estimate of the annual base salary range for this position is $100,000 - $126,500.

## Skills

### Required
- PowerShell
- Python
- Graph SDK
- EDR platforms
- Active Directory
- Entra ID
- digital forensics
- incident response

### Nice to have
- GCFA
- GCIH
- GNFA
- GCFE
- EnCE
- CISSP
- virtualization forensics
- Google Workspace forensics

---

Source: [Apply at job-boards.greenhouse.io](https://job-boards.greenhouse.io/charlesriverassociates/jobs/8130646?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)