Incident, Response & Forensic Analyst I

Job ID: 9059

Updated: Nov 10, 2026

Location: Chicago, IL, United States

Category: Security Governance

Apply Now

Share:

About Kirkland & Ellis

At Kirkland & Ellis, we don’t just meet the standard for legal excellence — we set it. Our culture is built on teamwork, ingenuity and an unwavering commitment to continuous growth. We tackle the most sophisticated legal challenges with bold ideas and innovative solutions, powered by the exceptional experience and ambition of our 7,000+ people, including 4,000+ attorneys, across 24 offices worldwide. Our dedicated professionals share our lawyers’ commitment to excellence and show up each day to do meaningful work that helps drive global business, investment and innovation forward.

What You’ll Do

Are you passionate about uncovering cyber threats, investigating complex security incidents, and protecting organizations from evolving risks?

As an Incident Response and Forensics Analyst I, you’ll play a critical role within the Security Governance team, supporting the organization's mission to safeguard people, systems, and data from cyber and physical threats. Reporting to the Director of Cyber Security Architecture and Forensics, you will work alongside incident responders, threat hunters, and security specialists to investigate threats, conduct forensic analyses, and strengthen the organization’s overall security posture.

This is an opportunity to contribute to high-impact investigations, collaborate across teams, and help drive rapid, effective responses to security incidents while protecting the integrity of critical business operations.

• Threat Intelligence: Monitor, manage, and investigate cyber threats using third-party threat intelligence platforms to identify risks affecting the organization, industry, and key stakeholders.
• Digital Forensics: Conduct forensic investigations using industry-standard tools such as Forensic Toolkit (FTK), EnCase, and similar technologies while maintaining the integrity and admissibility of evidence.
• Incident Response: Serve as a core member of the Computer Incident Response Team (CIRT), supporting the identification, containment, investigation, and recovery of security incidents.
• Threat Hunting: Participate in and help coordinate third-party red team and purple team exercises to proactively identify vulnerabilities and strengthen defenses.
• Sensitive Investigations: Conduct investigations involving insider threats, highly sensitive matters, human resources-related events, and other complex security incidents when required.
• Security Operations Support: Provide advanced support to Security Operations teams by reviewing security events, identifying root causes, and guiding escalation and remediation efforts.
• Data Analysis & Scripting: Leverage scripting languages and data analysis tools to examine large datasets, logs, and unstructured information to support investigations and threat analysis.
• Incident Leadership: Lead assigned activities during active incidents, ensuring proper evidence preservation, response procedures, and cross-functional coordination.
• Damage Assessment & Reporting: Assist with cause-and-origin investigations, perform forensic analysis of affected systems, and deliver clear technical and investigative reports to leadership.
• Collaboration & Communication: Coordinate with internal stakeholders and external partners to ensure effective communication, timely response, and successful resolution of security events.
• Risk Identification & Remediation: Identify cybersecurity risks, indicators of compromise, and remediation opportunities while supporting corrective action efforts.
• Quality & Continuous Improvement: Participate in peer reviews, condition assessments, and ongoing improvements to incident response and forensic processes.
• Operational Readiness: Manage competing priorities independently, respond effectively under tight timelines, and provide support outside standard business hours when incident response needs arise.

What You’ll Bring

• Education & Certifications: Bachelor’s degree in Cybersecurity or a related field preferred. Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), or similar technical certifications are preferred.
• Relevant Experience: At least five years of experience in information technology operations and/or engineering, including a minimum of three years focused on cybersecurity, compliance, risk management, or security technology implementation.
• Security Framework Knowledge: Familiarity with industry standards and frameworks such as International Organization for Standardization 27001 (ISO 27001), National Institute of Standards and Technology Special Publication 800-53 (NIST 800-53), Cybersecurity Framework (CSF), Center for Internet Security Controls (CIS), and MITRE ATT&CK.
• Technical Security Expertise: Hands-on experience with Security Information and Event Management (SIEM), endpoint security platforms, Network Intrusion Prevention Systems and Intrusion Detection Systems (IPS/IDS), privileged access management, vulnerability management, data loss prevention, and next-generation firewalls.
• Cloud Security Knowledge: Experience securing Microsoft 365 (M365) environments, Azure Infrastructure as a Service (IaaS), Azure Platform as a Service (PaaS), Cloud Access Security Broker (CASB), Cloud Security Posture Management (CSPM), and web application security technologies.
• Forensic & Investigation Skills: Strong understanding of forensic methodologies, evidence handling, incident investigation, threat analysis, and adversary tactics, techniques, and procedures.
• Communication & Influence: Ability to communicate technical and non-technical concepts effectively through presentations, documentation, reports, and stakeholder discussions.
• Problem Solving & Decision Making: Strong analytical thinking, sound judgment, and the ability to develop practical solutions in high-pressure situations.
• Leadership & Collaboration: Proven ability to guide teams, influence outcomes, foster collaboration, and contribute to complex initiatives across multiple stakeholder groups.
• Integrity & Confidentiality: Demonstrated commitment to handling sensitive information with discretion while maintaining the highest standards of ethics, professionalism, and trust.

If you’re excited to investigate sophisticated cyber threats, strengthen incident response capabilities, and make a meaningful impact as an Incident Response and Forensics Analyst I, we’d love to hear from you!

Compensation

The base salary range below represents the low and high end of the salary range for this position in Chicago. This range may differ based on your geographic location and cost of living considerations. At Kirkland & Ellis, we consider compensation more than just a base salary. We offer an exceptional range of flexible benefits including comprehensive healthcare, paid time off, and retirement. We also offer personal support and tailored learning and development opportunities all designed to help you realize your full potential both in life and at work.

Compensation Range:

Chicago: $130,000 - $144,000

How to Apply

Thank you for your interest in Kirkland & Ellis LLP. To complete an application and submit your resume, please click "Apply Now."

Don't meet every job requirement? That's okay! If you're excited about this role but your experience doesn't perfectly fit every qualification, we encourage you to apply anyway. You may be just the right person for this role or others at Kirkland.

Equal Employment Opportunity

All employment decisions, including the recruiting, hiring, placement, training availability, promotion, compensation, evaluation, disciplinary actions, and termination of employment (if necessary) are made without regard to the employee’s race, color, creed, religion, sex, pregnancy or childbirth, personal appearance, family responsibilities, sexual orientation or preference, gender identity, political affiliation, source of income, place of residence, national or ethnic origin, ancestry, age, marital status, military veteran status, unfavorable discharge from military service, physical or

mental disability, or on any other basis prohibited by applicable law. #LI-Hybrid #LI-AR1

Apply Now

Browse Jobs

Talent Network

About Us