Senior Analyst, Information Security

NRF • Houston, TX

27d

About The Position

At Norton Rose Fulbright, people thrive because of a shared commitment to quality, unity and integrity. The highly regarded law firm consistently receives recognition from Great Place to Work and Top Workplaces, two companies that specialize in assessing organizational culture. Teams collaborate across regions, value new ideas and deliver meaningful client solutions, supported by a culture that embraces ambition, development and shared success. With more than 3,000 lawyers and 3,000 business services professionals working together across 50 offices worldwide, this global law firm provides a full range of legal services to leading corporations and financial institutions operating in key markets and sectors. The Senior Information Security Analyst is one of several senior analyst roles within the Firm’s global Security Operations (SOC) team. Each Senior Analyst provides technical leadership in the SOC’s day-to-day monitoring, detection and response activities, hunts for emerging adversary activity, and continuously improves the Firm’s ability to detect and respond to threats at speed. The role is part of a worldwide team empowered to operate the activities within its assigned function. Daily activities focus on security monitoring, event and incident triage, incident response, request management, detection engineering and proactive threat hunting, with direction provided by the Information Security Manager.

Requirements

• Technical bachelor’s degree or equivalent IT / Information Security experience (required).
• At least 5 years’ experience working within security operations or Information Security infrastructure, or a strong vocation and demonstrable transferable experience from another technical discipline.
• Proven ability to adapt quickly to emerging threats or new information, shifting focus as needed.
• Demonstrated expertise in Microsoft 365 Defender and Microsoft Sentinel for detecting, investigating and responding to suspicious and anomalous activity.
• Strong knowledge of core security technologies (firewalls, IDS/IPS, EDR, SIEM) and of structured incident-response methodologies (e.g. NIST).
• Working knowledge of endpoint security and monitoring infrastructure (EDR, DLP, removable-media encryption) and of cloud-based web and email security solutions (e.g. Zscaler, Mimecast, Proofpoint, Cisco).
• Ability to triage and remediate phishing and impersonation attacks in a timely and efficient manner as the risk dictates.
• Experience working with a service management tool (e.g. ServiceNow).
• Demonstrable, in-depth expertise in at least one of the following domains, with solid working knowledge across the remainder: Identity & Access — deep experience detecting and responding to identity-based attacks across Active Directory and Entra ID / Azure AD, including conditional access, privileged access, authentication protocols and identity threat detection and response (ITDR).
• Cloud Security — deep experience monitoring and responding to threats across a major cloud platform (Azure, AWS or GCP), including cloud logging and telemetry, posture signals, and cloud-native detection and response.
• Windows & Linux Operating Systems — deep host-level investigation and forensic capability across both Windows and Linux, including event log and audit analysis, process and memory investigation, and OS hardening.
• Security Automation & Detection Engineering — advanced scripting (PowerShell and/or Python) and SOAR playbook development, and/or detection engineering (Sigma / KQL) to automate response and expand detection coverage at scale.

Nice To Haves

• Microsoft SC-200 (Security Operations Analyst)
• GIAC GSOC
• GIAC GCIH
• Blue Team Level 1 (BTL1) Specialist
• AZ-500 (Azure Security Engineer)
• SC-300 (Microsoft Identity and Access Administrator)
• GCFA (GIAC Certified Forensic Analyst)
• GCFE (GIAC Certified Forensic Examiner)
• GIAC GPYC (Python Coder)
• CompTIA Security+
• GIAC GSEC
• CISSP
• CCSP

Responsibilities

• Operate and manage security incidents and requests to SLA guidelines, acting as an intermediate escalation point for complex investigations.
• Monitor, triage and investigate alerts across endpoints, cloud, identity, email and network telemetry, reviewing and escalating unusual event behavior.
• Lead structured incident response aligned to a recognized lifecycle, including containment, eradication, recovery, evidence preservation and digital forensic analysis as authorized.
• Triage and remediate phishing, vishing and impersonation attacks in a timely and efficient manner as the risk dictates.
• Configure and tune appropriate security parameters in monitoring systems and act as a technical point of escalation for alerted issues.
• Conduct proactive, hypothesis-driven threat hunting on a scheduled basis to identify adversary activity not surfaced by existing detections.
• Design, test, tune and maintain detection rules and use cases (e.g. Sigma / KQL), and map detection coverage to the MITRE ATT&CK framework to identify and close detection gaps.
• Maintain technical awareness of adversary tradecraft, emerging attack techniques and threat intelligence relevant to the legal sector, translating these into new or improved detections.
• Develop and maintain security automation and orchestration (SOAR) playbooks to streamline incident response and automate repetitive operational tasks.
• Use AI-assisted detection, triage and investigation tooling effectively, and critically validate, tune and quality-assure AI-generated findings and recommendations.
• Act as a technical mentor for junior and peer analysts, supporting skills development and succession planning within the region.
• Take ownership of one or more SOC processes, functions or technologies globally, ensuring their continued maintenance and improvement.
• Assist with development and maintenance of SOC playbooks, runbooks, monitoring configuration and standard operating procedures, identifying improvements and reporting on incidents.

Benefits

• Access to three medical insurance plans
• Dental insurance
• Vision insurance
• Life insurance
• Disability insurance
• Pre-tax benefits such as health savings and flexible spending accounts
• 401(k) savings plan
• Profit-sharing plans
• Fertility benefits
• Commuter benefits
• Student loan assistance refinancing options
• Competitive paid time off plan (minimum of 20 days off based on role and tenure)
• Generous paid maternity leave
• Paid paternity leave (parental leave) benefit (minimum of 14 weeks)
• Child care support through a back-up care program
• 11 Firm holidays

What This Job Offers

• Job Type: Full-time
• Career Level: Senior