Evidence Handling Cybersecurity Jobs

1 job found

Today

Associate/Cybersecurity & Incident Response (Forensic Services practice)

Charles River Associates New York, NY

New York, NY

Today

$93k - $105k/yr Full time Cyber Forensics Cybersecurity Tools Data Security

Apply Now

Job Description

Charles River Associates is seeking an Associate for its Forensic Services practice, supporting cybersecurity and incident response work for CRA clients. The role centers on executing security and privacy investigations, providing expert digital forensic assistance during data security incidents, and turning technical findings into forensic deliverables that support legal and business outcomes.

This onsite position is based in New York, NY and is designed for candidates with hands-on experience in digital forensics, malware analysis, and threat-focused incident work, including evidence handling and control assessments aligned to recognized cybersecurity frameworks.

Role Summary

Execute security and privacy investigations related to data security matters, including ongoing breach detection, threat analysis, incident response support, and malware analysis
Provide digital forensic support for counsel and clients in cases such as data breaches and fraud
Draft forensic reports and affidavits, and testify as an expert in digital forensics and incident response
Perform forensic analysis using standard evidence handling techniques and computer forensics tooling
Produce technical assessments/audits and guidance on the adequacy of cyber security controls mapped to frameworks including NIST CSF 2.0, HIPAA, ISO 27001 and 27002, SOC 2, and NERC-CIP

Key Responsibilities

Acquire data and images from identified hosts, then locate evidence of compromise by analyzing disk, file, memory, and logs
Identify artifact and evidence locations to answer questions such as execution, file access, data theft, anti-forensics, and adversary system usage
Hunt and detect unknown live, dormant, and custom malware across enterprise environments
Create Indicators of Compromise (IOCs) to strengthen incident response and threat intelligence
Track adversary activity second-by-second using in-depth timeline analysis
Determine malware type (for example, rootkits, backdoors, and Trojan horses) and support appropriate defenses and response tactics
Identify lateral movement and pivots within client environments, showing how an adversary moves system to system
Use physical memory analysis tools to assess adversary activities on hosts and pivot points across a network
Examine traffic using common network protocols to identify patterns of activity and actions warranting investigation
Identify and track malware beaconing to command-and-control (C2) using memory forensics, registry analysis, and network connections
Assess the appropriateness and sufficiency of available data for access and analysis, including threat intelligence, logging data, and contextual clues
Recognize relationships among multiple sources and information types to support effective data analysis
Use programming and analysis tools including Python, T-SQL, VBA, Excel, and C# for programming, model building, and database administration
Implement quality control measures and documentation to support reliability of analysis and risk management
Participate in practice-building activities, including recruiting and training

Requirements

Bachelor’s or Master’s degree with a relevant academic focus (Computer Science, Digital Forensics, Information Security and/or Information Systems)
2-4 years of relevant work experience in financial/economic analysis, preferably in a consulting firm; applications accepted from recent graduates and candidates in the workforce
Digital forensics/incident response training and certifications, including SANS GIAC (GCFA, GCFE, GNFA, GIME), IACIS (CFCE or CIFR), Magnet MCFE, X-ways X-Pert or similar
Strong understanding of computer operating systems, software, and hardware
Ability to conduct detailed forensic investigations across computers, networks, mobile devices, and removable media
Experience performing digital forensic analysis with commercial and open source tools, including file system forensics, memory analysis, and network analysis
Experience with static/dynamic malware analysis in a lab environment, and threat hunting in a live environment
Experience with proper evidence handling procedures and chain of custody
Experience drafting technical and investigative reports and communicating technical findings
Experience using automation tools and scripts to expedite analysis
Understanding of incident handling procedures: preparation, identification, containment, eradication, and recovery
Understanding of common adversary attack techniques and how to leverage that knowledge to stop further adversary activity
Experience in collegiate computer security competitions

Technologies

Python, T-SQL, VBA, Excel, C#, SANS GIAC (GCFA, GCFE, GNFA, GIME), IACIS (CFCE or CIFR), Magnet MCFE, X-ways X-Pert
NIST CSF 2.0, ISO 27001, ISO 27002, SOC2, NERC-CIP

Compensation and Location

Location: New York, NY (onsite)
Salary: USD 92,500 - 105,000 per year (good-faith estimate of annual base salary range)
Additional compensation: may be eligible for bonus incentive compensation

Benefits

100 hours of training annually through formal and informal programs
Comprehensive total rewards program and a superior benefits package
Wellness programming supporting physical, mental, emotional, and financial well-being
In-house immigration support for foreign nationals and international business travelers
Medical, dental, and vision insurance
401(k) retirement plan with employer match
Life and disability insurance
Paid time off (vacation, sick leave, holidays)
Paid parental leave
Wellness programs and employee assistance resources
Commuter benefits

How to Apply

Resume: include current address, personal email, and telephone number
Cover letter: describe interest in CRA and how the role matches goals
Transcript: may be unofficial

Work Location Flexibility

CRA supports in-office time to enable career growth, mentorship, and inclusivity
Expect individuals to work in the office at least 3 to 4 days per week, with specific days coordinated with practice or team (may include travel to another CRA office or client meetings)

View full job page →

Get Evidence Handling Cybersecurity Jobs alerts

New Evidence Handling Cybersecurity Jobs, daily.