Overview As a Consulting Associate in CRA's Forensic Services, you will perform hands-on incident response and digital forensics to help clients address fraud, abuse, and non-compliance. You'll lead data collection, containment, and recovery across hybrid environments and communicate findings to counsel and stakeholders. The role combines technical execution with client-facing reporting under time pressure, offering exposure to high-stakes investigations. You'll work in a cross-functional team focused on integrity, risk reduction, and rapid value delivery.
Compensation / Benefits- 100 hours of training annually
- comprehensive benefits package
- wellness programs
- immigration support
- paid time off
- paid parental leave
Responsibilities- Execute digital forensic collection and analysis across Windows, Linux, virtualization (VMware, Hyper-V) and cloud (Azure, M365, Google Workspace) environments
- Perform endpoint and identity containment using EDR platforms (CrowdStrike Falcon or equivalent) with real-time response and telemetry analysis
- Lead technical recovery workstreams in ransomware matters: domain controller rebuild, credential resets, hypervisor/backup restoration, and gate-based validation
- Investigate business email compromise and wire fraud: mail flow reconstruction, tenant log analysis, OAuth and enterprise app audits, attacker attribution
- Analyze and remediate hybrid identity environments: Active Directory, Entra ID, Entra Connect, Conditional Access, and privileged access configurations
- Develop and maintain PowerShell, Graph SDK, and Python tooling for automation of collection, containment, and recovery
- Produce clear, defensible written work products: forensic reports, timelines, playbooks, client communications
- Support engagement scoping with technical LOE estimates grounded in evidence
- Interface directly with client IT teams, counsel, and carrier representatives during active matters
Key requirements- 3-5 years of hands-on experience in incident response or digital forensics
- Experience responding to ransomware, BEC, or intrusion matters in enterprise environments
- Deep working knowledge of Active Directory and Entra ID, including attacks and hardening
- Proficiency with at least one enterprise EDR platform and its response tooling
- Strong scripting ability in PowerShell; Python a plus
- Excellent written communication; able to produce report-quality prose
- Ability to operate independently under incident conditions and manage competing priorities across concurrent matters
- Excellent written and verbal communication
- Ability to work under pressure and manage multiple priorities
- Strong problem-solving and analytical thinking
- Windows, Linux, VMware, Hyper-V
- Azure, M365, Google Workspace
- EDR platforms (e.g., CrowdStrike Falcon)
