HHiring Reality
← Charles River Associates

Consulting Associate/Recovery Services (Forensic Services practice)

Charles River Associates
Location
Toronto, ON, Canada
Posted
1 month ago
Department
Forensic Services
Salary
$120,000 – $140,000
What they actually want (must-haves)
  • 3-5 years of hands-on experience in incident response, digital forensics, or a closely related security engineering role
  • Demonstrated experience responding to ransomware, BEC, or intrusion matters in enterprise environments
  • Deep working knowledge of Active Directory and Entra ID, including attack paths and hardening controls
  • Proficiency with at least one enterprise EDR platform and its response tooling
  • Strong scripting ability in PowerShell; Python a plus
  • Excellent written communication; able to produce report-quality prose without heavy editing
Nice to have
  • Industry certifications such as GCFA, GCIH, GNFA, GCFE, EnCE, CISSP, or equivalent
  • Experience with virtualization forensics and backup platform recovery
  • Familiarity with Google Workspace forensics and administrative tooling
  • Experience working under legal privilege with outside counsel and cyber insurance carriers
  • Exposure to OT/ICS environments or regulated industries (healthcare, financial services)
What the job really is

As a Consulting Associate in the Forensic Services practice at CRA, you will engage in hands-on technical incident response and forensic analysis, executing core workstreams related to recovery engagements. Your responsibilities will include digital forensic collection, analysis, and technical recovery actions in various environments, while also producing clear written reports and interfacing with clients and legal counsel during active matters.

Benefits
  • Comprehensive total rewards program including a superior benefits package
  • Wellness programming to support physical, mental, emotional and financial well-being
  • In-house immigration support for foreign nationals and international business travelers
  • 100 hours of training annually through formal and informal programs
  • Paid time off (vacation, sick leave, holidays)
  • Paid parental leave
Things to weigh
  • Incident response work may involve surge periods, including nights and weekends during active engagements
  • Work location flexibility requires at least 3 to 4 days a week in the office
Job score4.2/5
Benefits4/5
Freshness3/5
Career value4/5
Role clarity5/5
Pay transparency5/5

Applying to Charles River Associates?

See how your résumé matches this role — and tailor it from what actually gets interviews.

Calculate resume scoreGenerate resume to apply
Job Link →