Project Attorney, Cybersecurity

Orrick Herrington & Sutcliffe LLP•Any US Office, UNAVAILABLE

4d•Hybrid

About The Position

The Cybersecurity Project Attorney will support the fast-growing and internationally recognized Cybersecurity & Incident Response practice. This is a hands-on role focused on the operational and legal mechanics of incident response, offering the opportunity to develop deep expertise in one of the most dynamic areas of law while working closely with seasoned practitioners on high-profile matters. Our team manages cybersecurity incidents of every scale—including some of the largest and most complex events in history—from initial detection through resolution. The successful candidate will work with clients ranging from emerging companies to global enterprises across the technology, finance, life sciences and energy sectors. As a Project Attorney on the team, you will be embedded in live incident response engagements from the outset—supporting triage, fact development, regulatory analysis, client communications, forensic coordination, and breach notification workflows. You will receive hands-on training and mentorship and will have direct client exposure as you grow into the role. While the primary focus of this role is incident response, a Project Attorney will also have the opportunity to support cybersecurity-adjacent practices, including privacy and cybersecurity litigation and enforcement, as well as privacy and AI advisory work. In addition to substantive incident response work, the Cybersecurity Project Attorney will support projects to operationalize and improve the practice’s incident response capabilities, including developing and refining incident response workflows, intake and triage processes, and standard operating procedures to streamline the delivery of legal services during active incidents. This includes understanding the firm’s available resources and technology, and developing best practices and other programs to drive teams and tasks to the “right” resources (whether people, process, or technology). The role also involves working on projects to digitalize the practice, including automation, data capture and use of online resources, and supporting the firm’s data strategy, including tracking matter data, monitoring usage of practice content and resources, and capturing experience data. Support, coordinate, and lead projects to integrate technology, including generative AI, into the practice of law, including vetting, piloting, and supporting the onboarding of technology to support the legal practice. Support, coordinate, and lead projects to develop and improve client-facing solutions, including designing and improving solutions to share matter metrics, data, and regulatory insights with clients and teams. Capturing and leveraging matter, experience, and regulatory data to improve and inform future incident response engagements. Creating and automating knowledge and precedent libraries, including notification templates, regulatory reference materials, jurisdictional analysis tools, and response checklists. Identifying relevant practice content in collaboration with the firm’s Research & Information team, including third-party resources and forms, and integrating them into practice workflows. Identifying additional areas of opportunity for practice content and knowledge sharing and creation, and process improvements. Evaluating the efficient delivery of incident response legal services through internal data, external benchmarking, and market trend monitoring, and identifying opportunities to improve client service. Educating lawyers and legal professionals on incident response tools, firm resources, technology, and other initiatives to improve legal services. Communicating and consulting with attorneys, paralegals, and staff on efficiency, client solutions, and technology projects related to the practice. Developing and maintaining case studies and innovation materials to support marketing and business development for the practice.

Requirements

Juris doctorate (J.D.) from an accredited university or college and admission to practice in good standing in a US jurisdiction required.
One to three years of experience in cybersecurity incident response, privacy law, data security, or a related area of practice.
Superior written and verbal communication skills with demonstrated ability to present complex ideas to attorneys, managers, clients, and the public in layman’s terms.
Ability to solve practical problems and deal with a variety of concrete variables in situations where only limited standardization and/or specific direction exists.
Familiarity with breach notification laws, regulatory frameworks, and best practices for incident response workflows and documentation.
Understanding of the operational mechanics of incident response, including forensic investigations, regulatory reporting, and breach notification processes.
Familiarity with and enthusiasm about legal technology, including opportunities to leverage AI and generative AI in legal services.
Excellent analytical, project management, prioritization, and organization skills.
Self-starter with the ability to work independently with good judgment, handle multiple tasks simultaneously, and quickly prioritize projects.
Ability to work collaboratively at all organizational levels.
Flexible team player with ability to approach problems with a sense of ownership, enthusiasm, and innovation.
Strong interpersonal skills and the ability to communicate clearly and effectively with clients, forensic vendors, and internal teams under time-sensitive conditions.
Availability to travel as necessary.
Desire and ability to work beyond the position’s written duties and assist on other projects and initiatives, as needed.

Nice To Haves

Experience at a firm or in-house legal team handling data breach response is strongly preferred.

Responsibilities

Triaging and coordinating the response to security incidents across legal, technical, and business stakeholders
Analyzing applicable breach notification laws and advising on notification obligations and timelines
Advising on the security aspects of strategic corporate transactions
Advising security teams on the nascent legal landscape of offensive security and darkweb intelligence gathering
Directing and coordinating forensic investigations, including scoping engagements and liaising with forensic vendors
Assessing and managing regulatory reporting obligations, litigation holds, and related risk during active incidents
Drafting and reviewing incident-related communications, including notification letters, public statements, and internal updates
Conducting data impact assessments and supporting clients with post-incident remediation, readiness improvements, and governance
Developing and refining incident response workflows, intake and triage processes, and standard operating procedures to streamline the delivery of legal services during active incidents
Understanding the firm’s available resources and technology, and developing best practices and other programs to drive teams and tasks to the “right” resources (whether people, process, or technology)
Working on projects to digitalize the practice, including automation, data capture and use of online resources
Supporting the firm’s data strategy, including tracking matter data, monitoring usage of practice content and resources, and capturing experience data
Support, coordinate, and lead projects to integrate technology, including generative AI, into the practice of law, including vetting, piloting, and supporting the onboarding of technology to support the legal practice
Support, coordinate, and lead projects to develop and improve client-facing solutions, including designing and improving solutions to share matter metrics, data, and regulatory insights with clients and teams
Capturing and leveraging matter, experience, and regulatory data to improve and inform future incident response engagements
Creating and automating knowledge and precedent libraries, including notification templates, regulatory reference materials, jurisdictional analysis tools, and response checklists
Identifying relevant practice content in collaboration with the firm’s Research & Information team, including third-party resources and forms, and integrating them into practice workflows
Identifying additional areas of opportunity for practice content and knowledge sharing and creation, and process improvements
Evaluating the efficient delivery of incident response legal services through internal data, external benchmarking, and market trend monitoring, and identifying opportunities to improve client service
Educating lawyers and legal professionals on incident response tools, firm resources, technology, and other initiatives to improve legal services
Communicating and consulting with attorneys, paralegals, and staff on efficiency, client solutions, and technology projects related to the practice
Developing and maintaining case studies and innovation materials to support marketing and business development for the practice