Associate/Cybersecurity & Incident Response (Forensic Services practice)

About the role

CRA’s Forensic Services practice supports companies’ commitment to integrity by assisting them and their counsel in independently responding to allegations of fraud, waste, abuse, misconduct, and non-compliance. We deploy cross-trained teams of forensic professionals to assist clients in gaining deeper insights and greater value more quickly. We provide accounting and forensic services as well as cybercrime investigation services.

We value knowledge of cybersecurity concepts, research experience, quantitative ability, exceptional written and oral communication skills, and a high level of initiative. Associates are expected to use data to solve client problems, work collaboratively with a team, effectively manage their time, prioritize tasks, and take pride and ownership in their work.

Responsibilities

• Execute security and privacy investigations for CRA clients, including ongoing breach detection, threat analysis, incident response, and malware analysis.
• Provide expert digital forensic support for counsel and clients in response to data security incidents, such as data breaches or fraud.
• Assist in drafting forensic reports, affidavits, and testifying as an expert in digital forensics and incident response.
• Engage in problem-solving and forensic analysis of digital information using standard evidence handling techniques and computer forensics tools.
• Identify, research, and organize information to assess the appropriateness and sufficiency of available data for effective analysis.
• Develop familiarity with data inputs such as threat intelligence, logging data, and contextual clues.
• Recognize relationships among multiple sources and types of information to facilitate effective data analysis.
• Programming, model building, and database administration (Python, T-SQL, VBA, Excel, C#, among others).
• Ensure reliability of analysis and risk management through quality control measures and documentation.
• Forensically acquire data and images from identified hosts, then locate evidence of compromise and determine its impact through disk, file, memory, and log analysis.
• Identify artifact and evidence locations to answer critical questions, including execution, file access, data theft, anti-forensics, and detailed system usage by an adversary.
• Detect and hunt unknown live, dormant, and custom malware across multiple hosts in an enterprise environment.
• Create Indicators of Compromise (IOCs) from analysis to strengthen incident response and threat intelligence efforts.
• Track adversary activity second-by-second on a host via in-depth timeline analysis.
• Determine the type of malware used in an attack (e.g., rootkits, backdoors, Trojan horses) and choose appropriate defenses and response tactics.
• Identify lateral movement and pivots within client enterprises, showing how an adversary transitions between systems without detection.
• Use physical memory analysis tools to determine an adversary's activities on a host and other pivot points across the network.
• Examine traffic using common network protocols to identify patterns of activity or specific actions warranting further investigation.
• Identify and track malware beaconing outbound to its command and control (C2) channel via memory forensics, registry analysis, and network connections.
• Provide technical assessment, audit, and guidance to clients on the adequacy of cybersecurity controls in accordance with frameworks such as NIST CSF 2.0, HIPAA, ISO 27001/27002, SOC2, and NERC-CIP.
• Participate in practice-building activities, including recruiting and training.

Requirements

• Bachelor’s or Master’s degree with a relevant academic focus (Computer Science, Digital Forensics, Information Security, and/or Information Systems).
• 2-4 years of relevant work experience in financial/economic analysis, preferably in a consulting firm (recent graduates may be considered).
• Digital forensics/incident response training and certifications, including SANS GIAC (GCFA, GCFE, GNFA, GIME), IACIS (CFCE or CIFR), Magnet MCFE, X-ways X-Pert, or similar.
• Strong understanding of computer operating systems, software, and hardware.
• Ability to conduct detailed forensic investigations and analysis of computers, networks, mobile devices, and removable media.
• Experience with digital forensic analysis using commercial and open-source tools, including file system forensics, memory analysis, and network analysis.
• Experience with static/dynamic malware analysis in a lab environment and threat hunting in a live environment.
• Experience in collegiate computer security competitions (preferred).
• Strong understanding of proper evidence handling procedures and chain of custody.
• Experience drafting technical and investigative reports and communicating technical findings.
• Experience utilizing automation tools and scripts to expedite analysis.
• Understanding of incident handling procedures: preparation, identification, containment, eradication, and recovery to protect enterprise environments.
• Understanding of common attack techniques used by adversaries on victim networks and leveraging those techniques to stop further activity.

Benefits

• Comprehensive total rewards program, including a superior benefits package (medical, dental, vision insurance, 401(k) with employer match, life and disability insurance).
• Paid time off (vacation, sick leave, holidays) and paid parental leave.
• Wellness programs and employee assistance resources.
• Commuter benefits.
• In-house immigration support for foreign nationals and international business travelers.
• Robust skills development programs, including 100 hours of training annually through formal and informal programs (e.g., technical training, presentation skills, internal seminars, career mentoring, and performance coaching).
• Leadership and collaboration opportunities through internal firm development activities.

Pay

Annual base salary range: $92,500 - $105,000. Starting pay may vary based on education, experience, skills, geographic location, market conditions, and other qualifications. This position may also be eligible for bonus incentive compensation.

Schedule

Individuals are expected to spend at least 3 to 4 days a week working in the office (which may include traveling to another CRA office or client meetings), with specific days determined in coordination with your practice or team.