Description
The Team
Alvarez & Marsal's (A&M's) Global Cyber Risk Services (GCRS) practice helps Boards and management teams understand and manage cyber risk, strengthen resilience, support transactions, and respond with confidence when incidents occur. As the cyber landscape continues to evolve, we help clients see that cybersecurity is not a technology issue, but a business issue. Our methods are grounded in guidance from the regulatory and industry frameworks and best practices that govern our clients' specific business. Our team of cybersecurity experts provides prioritized findings, observations, recommendations, and a roadmap for gap closure, using expertly developed methodologies, tools, and techniques to identify vulnerabilities, system misconfigurations, and program deficiencies and improve our clients' overall cyber posture and process maturity.
Our Services
A&M's team includes former Chief Information Security Officers (CISOs), forensic investigators, offensive security practitioners, and senior information security professionals who help organizations articulate a strategic vision that goes well beyond the day-to-day management of cybersecurity. GCRS delivers across four service lines:
• Cyber Risk Advisory: program maturity assessments (ISO 27001, NIST, CIS Controls), risk-based program prioritization, security and privacy governance, data privacy and cyber compliance (GDPR, CCPA, NYDFS, HIPAA, PCI-DSS), third-party risk, AI security assessments, and board reporting.
• Incident Response & Forensic Investigations: breach and ransomware response, cyber war room management, comprehensive forensic investigations and log analysis, malware reverse engineering, Microsoft 365 investigations, AI incident response, expert witness and litigation support, and incident response retainers.
• Cyber Resilience: incident response program development, ransomware readiness and playbooks, cyber threat simulations and tabletop exercises, red teaming and penetration testing, threat hunting and compromise assessments, application, network, cloud and OT security assessments, and secure DevOps.
• Cybersecurity Transaction Advisory: buy-side, sell-side, and carve-out cybersecurity due diligence, Day 1 readiness, separation and integration support (IMO/SMO), TSA governance and exit planning, and post-close performance improvement.
Our clients choose A&M for our technical depth, board-level judgment, and product-agnostic approach. A&M is accredited by the National Security Agency (NSA) as a Cyber Incident Response Assistance (CIRA) firm and is a CREST Cybersecurity Incident Response provider, with a global footprint and dedicated cyber and forensics labs that enable in-region data handling and rapid on-the-ground response.
Across GCRS, we are building practical capability to help clients navigate the security implications of artificial intelligence, including AI governance, model and pipeline security, and the emerging risks of agentic AI systems, as well as the use of AI by threat actors.
How you will contribute
Our Global Cyber Risk Services (GCRS) team is seeking a Senior Associate - Cyber Incident Response and Forensics Services. You will be a key part of the continued growth of our practice. Working with organizations across all industries, you will develop your career by listening to and understanding our clients and communicating creative solutions for their specific needs, in a field where there really are no off-the-shelf recommendations.
As a Senior Associate within our Incident Response and Forensics team, you will work on the front lines of some of the most significant cyber events our clients face, from ransomware and business email compromise to cloud, SaaS, and insider incidents. You will balance hands-on technical investigation with direct client engagement, helping organizations contain an incident, determine what happened, and recover with confidence.
The nature of this role means no two engagements will be the same. You may spend one week performing on-site forensic collection at a co-located data center, the next analyzing a Microsoft 365 tenant compromise, and the next supporting a proactive tabletop exercise or incident response plan development for a client preparing for the next event. Increasingly, you will also help clients investigate and respond to incidents involving AI-enabled attacks and compromised AI and agentic systems.
As cyber-crime continues to threaten businesses large and small, threat actors are improving their tactics, techniques, and procedures faster than corporate security teams can keep up, and are increasingly organized, collaborative, and AI-enabled. When our clients do not have the knowledge or resources to take on the threat of a cyber-attack, they look to us for expertise and partnership.
Key Responsibilities
• Perform post-breach incident response and digital forensic investigations, including host-based analysis of Windows, Linux, and macOS systems to identify indicators of compromise (IOCs), establish timelines, and determine root cause.
• Support containment, eradication, and recovery activities in coordination with client IT, legal counsel, insurers, and other third parties.
• Investigate ransomware and extortion events, business email compromise, and data theft, including Microsoft 365, Entra ID, Google Workspace, and other SaaS investigations.
• Conduct cloud forensics and investigations across AWS, Azure, and GCP, including log acquisition, identity and access analysis, and attacker activity reconstruction.
• Perform memory, disk, network, and log analysis using enterprise forensic and EDR tooling and custom scripts; perform malware triage and behavioral analysis, and support reverse engineering where required.
• Examine firewall, web, database, authentication, and other log sources to identify evidence of malicious or compromised activity, and support threat hunting and compromise assessments.
• Investigate incidents involving AI and agentic systems, including prompt injection, tool and permission misuse, excessive agency, data exfiltration through AI agents and connectors, and compromise of AI development and integration pipelines, and recognize AI-enabled attacker techniques such as synthetic-media social engineering and AI-assisted phishing and malware development.
• Maintain chain of custody and evidence handling procedures that support legal, regulatory, and litigation needs, and support expert witness and litigation matters as required.
• Prepare clear, defensible written reports, executive briefings, and incident timelines for technical teams, executives, Boards, counsel, and regulators.
• Support proactive client engagements, including incident response plan and playbook development, ransomware readiness, tabletop exercises, and incident response retainers.
• Contribute to the development of GCRS forensic tooling, playbooks, and methodologies, including AI-assisted analysis techniques, and mentor analysts and interns.
Skills and Attributes for Success
• Perform and/or lead defined components of incident response and forensic investigations in client environments of all sizes and industries.
• Apply a structured, evidence-driven approach to ambiguous and fast-moving situations while remaining calm and credible with client leadership.
• Demonstrate deep curiosity about attacker tradecraft and keep current on emerging threat actors, attack vectors, and defensive techniques, including those introduced by generative and agentic AI.
• Take responsibility for managing workstreams, including ownership of client communication, coordination of internal resources, and planning and execution of assessment or response activities.
• Communicate information security and technology issues verbally and in writing, formally and informally, to all levels of client staff, from senior executives to technical users, and produce high-quality written reports and documents.
• Work independently to manage and execute multiple engagements in diverse client environments, keep management apprised of status, bring engagements to completion, and follow up with clients on results.
• Develop tools, scripts, and documentation for internal team use, and actively contribute to the maintenance and enhancement of team systems, playbooks, and processes.
• Develop and complete an education plan to grow your skills consistent with client needs, and support the development of junior team members through coaching and feedback.
• Promote awareness of the team by building relationships, publishing whitepapers or advisories, contributing to marketing materials, or presenting at conferences.
Qualifications
Required
• Bachelor's degree in Computer Science, Cybersecurity, Information Systems, Digital Forensics, or a related field (or equivalent experience), supported by approximately 3-6 years of relevant experience in incident response, digital forensics, or security operations; consulting or professional services experience is preferred.
• Active GIAC/SANS certification(s) in digital forensics and/or incident response, such as GCFE (Certified Forensic Examiner), GCIH (Certified Incident Handler), GCFA (Certified Forensic Analyst), GNFA, GREM, or GX-FA. At minimum, one of GCFE or GCIH is required.
• Hands-on experience performing host-based forensics on Windows, Linux, and/or macOS, including memory, disk, and artifact analysis.
• Experience investigating real-world intrusions such as ransomware, business email compromise, or cloud account compromise, and producing written findings.
• Working knowledge of forensic and response tooling such as EnCase, FTK, Magnet AXIOM, X-Ways, Velociraptor, KAPE, Volatility, F-Response, SIFT, Splunk or other SIEM platforms, and commercial EDR platforms (e.g., CrowdStrike, Microsoft Defender, SentinelOne).
• Working knowledge of scripting or programming (e.g., Python, PowerShell, Bash) for automation and analysis.
• Solid understanding of the MITRE ATT&CK framework and common attacker lifecycle, including initial access, persistence, lateral movement, and exfiltration.
• Ability to occasionally work weekends and/or off hours as necessary to meet client needs, including time-sensitive, high-pressure situations
• Ability and willingness to travel as needed
• Strong written and verbal communication skills, with the ability to interact effectively with stakeholders from technical staff to Board members
• Strong analytical skills, solid attention to detail, and a penchant for accuracy
• History of balancing competing priorities and adapting to changing client needs while meeting deadlines
• Proven ability to create and maintain technical documentation for enterprise-level clients
Preferred / Plus
• Additional certifications such as GRID, GICSP, EnCE, CFCE, CCFP, or equivalent; a CISSP is a plus.
• Understanding of threats and attack vectors associated with agentic AI and LLM-based systems (e.g., prompt injection, tool abuse, insecure agent-to-tool protocols, excessive agency, data leakage, AI supply chain risk), with familiarity with the OWASP Top 10 for LLM Applications, OWASP agentic AI guidance, and MITRE ATLAS.
• Experience with cloud-native forensics in AWS, Azure, or GCP, with Kubernetes and container forensics, or with OT/ICS incident response.
• Experience with malware analysis and reverse engineering, threat intelligence, or threat hunting.
• Experience supporting regulatory inquiries, cyber insurance matters, or litigation, and working alongside outside counsel under privilege.
• Experience on a Big Four, specialist DFIR consultancy, or leading cyber response firm.
Across all GCRS roles, a solid understanding of artificial intelligence and the threats posed by and to AI systems is a plus.
Your journey at A&M
At A&M, professional growth is tied directly to performance, not tenure. Our people take on meaningful, hands-on work supported by a performance development process that rewards contribution and fosters a culture of meritocracy. Stretch roles, evolving business needs, and firm growth create ongoing opportunities for ownership and building new skills, while direct access to senior leaders provides mentorship and real-time coaching along the way. We also prioritize your wellbeing through comprehensive benefits and resources. Together, these elements create an environment where high-performing professionals can continue to grow and advance from day one.
Regular employees working 30 or more hours per week are also entitled to participate in Alvarez & Marsal Holdings' fringe benefits consisting of healthcare plans, flexible spending and savings accounts, life, AD&D, and disability coverages at rates determined periodically as well as a 401(k) retirement savings plan. Provided the eligibility requirements are met, employees will also receive an annual discretionary contribution to their 401(k) retirement savings plan from Alvarez & Marsal. Additionally, employees are eligible for paid time off including vacation, personal days, seventy-two (72) hours of sick time (prorated for part time employees), ten federal holidays, one floating holiday, and parental leave. The amount of vacation and personal days available varies based on tenure and role type. Click here for more information regarding A&M's benefits programs.
The salary range is $85,000 - $120,000 annually, dependent on several variables including but not limited to education, experience, skills, and geography. In addition, A&M offers a discretionary bonus program which is based on a number of factors, including indi
