Consulting Associate/Recovery Services (Forensic Services practice)
Core
Hands-on technical responder and forensic analyst executing incident response and recovery engagements for fraud, waste, abuse, and non-compliance allegations.
Role type
Senior IC digital forensic analyst (incident response & recovery)
Builds
Forensic reports, investigation timelines, containment playbooks, and client status communications for legal counsel and carriers.
Domain
Cybersecurity incident response, digital forensics, and enterprise identity recovery
Deliverable
production ML models | product features | dashboards & analysis | research | client delivery | infrastructure | physical/clinical work
Required skills
Digital forensic collection and analysis, Endpoint and identity containment, Ransomware response and recovery, Business email compromise (BEC) investigation, Hybrid identity environment remediation, PowerShell and Python scripting
Preferred skills
Industry certifications (GCFA, GCIH, CISSP), Virtualization forensics, Google Workspace forensics, Legal privilege experience, OT/ICS environment exposure
Technologies
Windows, Linux, VMware, Hyper-V, Azure, M365, Google Workspace, CrowdStrike Falcon, Active Directory, Entra ID, PowerShell, Python, Graph SDK
Responsibilities
Execute digital forensic collection and analysis across hybrid and cloud environments; Perform endpoint and identity containment using EDR platforms; Lead technical recovery workstreams in ransomware matters; Investigate business email compromise and wire fraud; Analyze and remediate hybrid identity environments; Develop automation tooling for collection and recovery.
Seniority
Mid-level (3-5 years), hands-on IC