Associate/Cybersecurity & Incident Response (Forensic Services practice)

About the role

CRA’s Forensic Services practice supports companies’ commitment to integrity by assisting them and their counsel in independently responding to allegations of fraud, waste, abuse, misconduct, and non-compliance. We deploy cross-trained teams of forensic professionals to help clients gain deeper insights and greater value more quickly. The role involves providing accounting, forensic, and cybercrime investigation services, with a focus on cybersecurity concepts, research, quantitative analysis, and strong communication skills.

Responsibilities

• Execute security and privacy investigations for clients, including breach detection, threat analysis, incident response, and malware analysis.
• Provide expert digital forensic support for data security incidents such as breaches or fraud.
• Assist in drafting forensic reports, affidavits, and testifying as an expert in digital forensics and incident response.
• Perform forensic analysis of digital information using standard evidence handling techniques and computer forensics tools.
• Identify, research, and organize information to assess data sufficiency for effective analysis.
• Develop familiarity with data sources such as threat intelligence, logging data, and contextual clues.
• Recognize relationships among multiple sources and types of information to facilitate data analysis.
• Program, build models, and administer databases using Python, T-SQL, VBA, Excel, and C#.
• Implement quality control measures and documentation to ensure analysis reliability and risk management.
• Forensically acquire data and images from hosts, locate evidence of compromise, and determine impact through disk, file, memory, and log analysis.
• Identify artifact and evidence locations to answer critical questions about execution, file access, data theft, anti-forensics, and adversary system usage.
• Detect and hunt live, dormant, and custom malware across enterprise environments.
• Create Indicators of Compromise (IOCs) to strengthen incident response and threat intelligence efforts.
• Track adversary activity via in-depth timeline analysis.
• Determine malware types (e.g., rootkits, backdoors, Trojans) and recommend appropriate defenses and response tactics.
• Identify lateral movement and pivots within client enterprises to trace adversary transitions between systems.
• Use physical memory analysis tools to determine adversary activities and pivot points across networks.
• Examine network traffic to identify patterns warranting further investigation.
• Track malware beaconing to command and control (C2) channels via memory forensics, registry analysis, and network connections.
• Provide technical assessments and guidance on cybersecurity controls aligned with frameworks such as NIST CSF 2.0, HIPAA, ISO 27001/27002, SOC2, and NERC-CIP.
• Participate in practice-building activities, including recruiting and training.

Requirements

• Bachelor’s or Master’s degree in Computer Science, Digital Forensics, Information Security, or Information Systems.
• 2–4 years of relevant work experience in financial/economic analysis, preferably in a consulting firm (recent graduates may be considered for the Analyst title).
• Digital forensics/incident response training and certifications (e.g., SANS GIAC: GCFA, GCFE, GNFA, GIME; IACIS: CFCE or CIFR; Magnet MCFE; X-ways X-Pert).
• Strong understanding of computer operating systems, software, and hardware.
• Ability to conduct detailed forensic investigations of computers, networks, mobile devices, and removable media.
• Experience with digital forensic analysis using commercial and open-source tools, including file system forensics, memory analysis, and network analysis.
• Experience with static/dynamic malware analysis in lab environments and threat hunting in live environments.
• Experience in collegiate computer security competitions.
• Strong understanding of evidence handling procedures and chain of custody.
• Experience drafting technical and investigative reports and communicating technical findings.
• Experience with automation tools and scripts to expedite analysis.
• Understanding of incident handling procedures: preparation, identification, containment, eradication, and recovery.
• Knowledge of common attack techniques and leveraging them to mitigate adversary activity.

Benefits

• 100 hours of annual training through formal and informal programs, including technical training, presentation skills, and career mentoring.
• Comprehensive total rewards program, including medical, dental, and vision insurance.
• 401(k) retirement plan with employer match.
• Life and disability insurance.
• Paid time off (vacation, sick leave, holidays) and paid parental leave.
• Wellness programs and employee assistance resources.
• Commuter benefits.
• In-house immigration support for foreign nationals and international business travelers.

Pay

Annual base salary range: $92,500 – $105,000. Starting pay may vary based on education, experience, skills, geographic location, and market conditions. Eligible for additional bonus incentive compensation.

Schedule

Hybrid work environment with an expectation of 3–4 days per week in the office (or traveling to another CRA office or client meetings). Specific days determined in coordination with your practice or team.