Consulting Associate/Recovery Services (Forensic Services practice)
Charles River Associates
Toronto, Ontario
The Role
This position sits within a forensic services practice focused on fraud, misconduct, and cybercrime investigations. Day to day, practitioners collect and analyse digital evidence across Windows, Linux, virtualised, and cloud environments, lead incident containment and eradication, and support enterprise infrastructure recovery during active ransomware engagements.
Skills & Experience
Candidates should have hands-on experience with EDR platforms such as CrowdStrike Falcon, virtualisation technologies including VMware and Hyper-V, and cloud environments such as Azure and Microsoft 365. Familiarity with domain controller rebuilds and forensic imaging methodologies is essential. Relevant certifications in digital forensics or incident response are advantageous.
Who It Suits
This role suits a technically grounded practitioner who thrives under pressure and moves comfortably between deep forensic analysis and clear communication with legal counsel. Someone equally confident working overnight on a compromised host and presenting findings to a non-technical audience the following morning will excel here.
Typical advertised salary for Incident Response roles in Canada: C$97,000–C$158,000 (median C$130,000 — from 40 recent listings analysed by Forensic Focus).
Learn More/Apply
