Information Security Analyst

Gibson Dunn•Los Angeles, CA

7d•$150,000 - $200,000

About The Position

Based in Los Angeles or New York, the Information Security Analyst responds to events and alerts generated by information security technologies, user-reported events, and other activity suggestive of a potential information security event or incident. This hands-on technologist has expertise in security event investigation, analysis, and incident response, and serves as a subject matter expert for the firm’s security event detection and response technologies. The role has a firm-wide scope and requires understanding the firm’s IT systems and how they support the business. Working closely with the Information Security Team, the analyst helps maintain the firm’s information security posture and proactively assesses the security of systems throughout their lifecycle, recommending improvements in response to threats and vulnerabilities. The position reports to the Director of Security Operations. It also monitors and investigates events involving AI, machine learning, generative AI, and large language models, including potential misuse and related threats.

Requirements

University degree in a technology-related discipline or three years of relevant experience.
Five to seven years of experience in a dedicated information security analysis role.
Three to five years of information technology experience in an area such as networking, desktop engineering, programming, systems administration, or help desk.
Strong critical-thinking and problem-solving skills.
Practical experience with TCP/IP networking.
Significant experience with the Windows operating system and event logs.
Significant experience and expertise with security event detection, analysis, and incident response tools and practices.
Significant experience using SIEM platforms to search and correlate events, including building complex searches and correlation rules.
Strong knowledge of networking concepts, including DNS, switching, routing, and firewalls.
Ability to communicate with non-technical users in user-friendly language and understand or learn the technical implications of security threats.
Ability to manage multiple concurrent objectives, prioritize, and allocate time effectively in a high-pressure environment.
Ability to adapt to change, gauge personal strengths and limitations, and work independently and as part of a team.
Ability to maintain strict confidentiality of the firm’s internal and personnel affairs.
Ability to collaborate with others, work in a multi-office and culturally and educationally diverse environment, and travel to other offices as required.
Excellent troubleshooting, problem-solving, verbal, and written communication skills; strong interpersonal and organizational skills.
Ability to manage critical situations, maintain relationships with colleagues, firm staff, and attorneys, anticipate and communicate problems, and resolve them where appropriate.
Detail orientation, strong customer service skills, professional and positive customer interactions, and ownership of issues and customer satisfaction.
Familiarity with AI security concepts such as prompt injection, data leakage, model manipulation, insecure integrations, excessive agency, and adversarial use of AI.
Ability to communicate AI-related security risks and technical findings clearly to technical and non-technical audiences.
Experience investigating security events involving cloud applications, APIs, automation platforms, or AI-enabled technologies.
Experience developing or tuning detections for emerging threats, including AI-assisted phishing, impersonation, malware, credential attacks, and social engineering.
Experience using AI-assisted capabilities in security technologies such as SIEM, endpoint detection and response, email security, threat intelligence, vulnerability management, or security orchestration platforms.
Practical experience applying human oversight and validation to AI-generated security findings, recommendations, or automated actions.

Responsibilities

Serve as a primary escalation point and subject matter expert for security event and incident detection and response.
Analyze and respond to security events identified internally or through the firm’s Managed Security Service Providers.
Review security context alerts and logs using the firm’s SIEM platform and other tools.
Build dashboards and custom SIEM queries to support detection, response, and other use cases.
Serve as an initial point of contact for help desk tickets assigned to the Information Security Team.
Respond promptly to end-user and other requests for assistance concerning incidents or security concerns.
Escalate security events and incidents according to defined workflows and applicable SLAs.
Document the results of security event and incident investigations thoroughly.
Follow relevant policies, procedures, standards, and accepted security practices.
Resolve problems independently and follow escalation procedures as needed.
Respond promptly to requests for access or security exceptions requiring the Information Security Team’s approval or involvement.
Maintain current security certifications and attend industry seminars and relevant continuing education events.
Monitor and investigate security events involving AI, machine learning, generative AI, and large language model technologies.
Identify and investigate potential AI misuse, including unauthorized AI services, sensitive data exposure, prompt injection, malicious content generation, and AI-assisted social engineering.
Develop and maintain detection queries, correlation rules, dashboards, and response procedures for AI-related threats and anomalous activity.