Information Security Analyst

Gibson Dunn•Los Angeles, NY

About The Position

Gibson Dunn is a leading global law firm advising clients on significant transactions and disputes. Based in Los Angeles or New York, the Information Security Analyst responds to alerts generated by information security technologies, user-reported events, and other activity suggesting a potential security event or incident. This hands-on technologist is an expert in investigating security events, incident response, and the technologies used to detect and respond to them, serving as a subject matter expert for those technologies. The role has firm-wide scope and requires understanding the firm’s IT systems and their business value. Working closely with the Information Security Team, the analyst helps maintain the firm’s security posture, proactively assesses systems throughout their lifecycle, and recommends security enhancements in response to evolving threats and vulnerabilities. The position reports to the Director of Security Operations. It also monitors and investigates events involving AI, machine learning, generative AI, and large language models, including potential misuse, sensitive-data exposure, prompt injection, malicious content generation, and AI-assisted social engineering.

Requirements

A university degree in a technology-related discipline or 3 years of relevant experience.
5–7 years of experience in a dedicated information security analysis role.
3–5 years of experience in information technology, such as networking, desktop engineering, programming, systems administration, or help desk.
Strong critical-thinking and problem-solving skills.
Practical experience with TCP/IP networking.
Significant experience with the Windows operating system and event logs.
Significant experience with security event detection, analysis, and incident response tools.
Significant experience conducting security event analysis and incident response.
Expertise using SIEM platforms to search and correlate events, including building complex searches and correlation rules.
Strong knowledge of networking concepts, including DNS, switching, routing, and firewalls.
Experience investigating security events involving cloud applications, APIs, automation platforms, or AI-enabled technologies.
Experience developing or tuning detections for emerging threats, including AI-assisted phishing, impersonation, malware, credential attacks, and social engineering.
Experience using AI-assisted capabilities in security technologies such as SIEM, endpoint detection and response, email security, threat intelligence, vulnerability management, or security orchestration platforms.
Practical experience applying human oversight and validation to AI-generated security findings, recommendations, or automated actions.
Familiarity with AI security concepts such as prompt injection, data leakage, model manipulation, insecure integrations, excessive agency, and adversarial use of AI.
Ability to communicate AI-related security risks and technical findings clearly to technical and non-technical audiences.
Ability to explain technical matters to non-technical users in user-friendly language and understand or learn the technical implications of security threats.
Ability to manage concurrent objectives, prioritize effectively, and allocate time in a high-pressure environment.
Ability to gauge personal strengths and limitations, adapt to change, and work independently as well as with a team.
Ability to maintain strict confidentiality of the firm’s internal and personnel affairs.
Ability to work well with others, bring together different skills and experiences, and build team spirit.
Ability to work in a multi-office environment and willingness to travel to other offices as required.
Ability to work effectively in a culturally and educationally diverse environment.
Excellent troubleshooting, problem-solving, verbal, and written communication skills.
Ability to manage critical situations and maintain strong relationships with colleagues, firm staff, and attorneys.
Ability to anticipate problems, communicate them, and resolve them when appropriate.
Detail-oriented, with strong customer service, interpersonal, and organizational skills.
Ability to take ownership of issues and responsibility for customer satisfaction and the success of services provided.
Ability to interact with diverse customers in a polite, positive, and professional manner.

Responsibilities

Serve as a primary escalation point for security events and as a subject matter expert for event and incident detection and response.
Analyze and respond to security events identified internally or through the firm’s Managed Security Service Providers.
Review security context alerts and logs using the firm’s SIEM platform and other tools.
Build dashboards and custom SIEM queries to facilitate detection, response, and other use cases.
Serve as an initial point of contact for help desk tickets assigned to the Information Security Team.
Respond promptly to requests from end users and others regarding incidents or security concerns.
Escalate security events and incidents according to defined workflows and applicable SLAs.
Thoroughly document the results of security event and incident investigations.
Adhere to relevant policies, procedures, standards, and accepted security practices.
Resolve problems independently and follow escalation procedures where appropriate.
Respond promptly to requests for access or other security exceptions requiring Information Security Team approval or involvement.
Maintain current security certifications and attend industry seminars and relevant continuing education events.
Monitor and investigate security events involving artificial intelligence, machine learning, generative AI, and large language model technologies.
Identify and investigate potential AI misuse, including unauthorized AI services, sensitive-data exposure, prompt injection, malicious content generation, and AI-assisted social engineering.
Develop and maintain detection queries, correlation rules, dashboards, and response procedures for AI-related threats and anomalous activity.