Associate/Cybersecurity & Incident Response (Forensic Services practice)

$87,000 - $91,000/Yr

Charles River Associates - Boston, MA

Full-time - Entry Level

Remote - Boston, MA

Professional, Scientific, and Technical Services

About the position

The Associate position in Cybersecurity & Incident Response at Charles River Associates (CRA) involves supporting the Forensic Services practice by executing security and privacy investigations, providing expert digital forensic support, and assisting in drafting forensic reports. The role requires analytical skills, knowledge of cybersecurity concepts, and the ability to work collaboratively in a team environment. Associates will engage in problem-solving, forensic analysis, and utilize various tools to address client needs related to data security incidents.

Responsibilities

• Executing security and privacy investigations for CRA clients in response to data security matters.
• Providing expert digital forensic support for counsel and clients during data breaches or fraud incidents.
• Assisting in drafting forensic reports and testifying as an expert in digital forensics and incident response.
• Engaging in forensic analysis of digital information using standard evidence handling techniques and computer forensics tools.
• Identifying, researching, and organizing information to assess data appropriateness for effective analysis.
• Developing familiarity with data inputs for analysis, including threat intelligence and logging data.
• Recognizing relationships among multiple sources of information to facilitate effective data analysis.
• Programming, model building, and database administration using languages such as Python, T-SQL, and C#.
• Ensuring reliability of analysis through quality control measures and documentation.
• Forensically acquiring data and images from identified hosts and locating evidence of compromise.
• Detecting and hunting unknown malware across multiple hosts in an enterprise environment.
• Creating Indicators of Compromise (IOCs) to strengthen incident response efforts.
• Tracking adversary activity through in-depth timeline analysis.
• Understanding evidence needed to determine malware types and appropriate defenses.
• Identifying lateral movement within client enterprises to show adversary transitions.
• Using physical memory analysis tools to determine adversary activities on hosts.
• Examining traffic using common network protocols to identify patterns warranting further investigation.
• Providing technical assessments and guidance on cybersecurity controls according to frameworks like NIST CSF and HIPAA.

Requirements

• 2-4 years of experience in Computer Science, Digital Forensics, Information Security, or Information Systems.
• Strong understanding of computer operating systems, software, and hardware.
• Ability to conduct detailed forensic investigations and analysis of computers, networks, and mobile devices.
• Experience with digital forensic analysis using commercial and open-source forensic tools.
• Experience with conducting static/dynamic malware analysis and threat hunting.
• Strong understanding of proper evidence handling procedures and chain of custody.
• Experience with drafting technical and investigative reports.
• Understanding incident handling procedures: preparation, identification, containment, eradication, and recovery.
• Digital forensics/incident response training and certifications, such as SANS GIAC or IACIS.

Nice-to-haves

• Experience in collegiate computer security competitions.
• Experience with utilizing automation tools and scripts to expedite analysis.
• Understanding of common attack techniques used by adversaries.

Benefits

• 100 hours of training annually through formal and informal programs.
• Comprehensive total rewards program including wellness programming.
• In-house immigration support for foreign nationals and international business travelers.