Information Security Analyst

Katten is a full-service law firm with approximately 650 attorneys in locations across the United States and in London and Shanghai. Clients seeking sophisticated, high-value legal services turn to Katten for counsel locally, nationally and internationally. The firm’s core areas of practice include corporate, financial markets and funds, restructuring, intellectual property, litigation, real estate, structured finance and securitization, transactional tax planning, private credit and private wealth.

Katten represents public and private companies in numerous industries, as well as a number of government and nonprofit organizations and individuals.

Reporting to the Information Security Manager, the Information Security Analyst monitors, investigates, and responds to security events across the organization while helping improve threat detection, incident response, and data protection capabilities. The Analyst independently investigates security concerns, identifies emerging threats, and recommends practical enhancements to strengthen the Firm's security posture. Maintains professionalism and strict confidentiality in all client and Firm matters.

Katten offers a hybrid work model, allowing the flexibility to work both on-site and remotely on a regular basis (Katten Flex).

• Analyze security logs and correlate data from multiple sources to identify suspicious or anomalous activity.

• Conduct proactive threat hunting and identify indicators of compromise before they develop into larger incidents.

• Investigate DLP, endpoint, XDR/EDR, and Zscaler alerts, documenting findings and escalating issues as appropriate.

• Support incident response activities, including evidence collection, analysis, containment, remediation, and post-incident review.

• Collaborate with IT, infrastructure, application, and business stakeholders on investigations and risk mitigation efforts.

• Assist in developing and enhancing detection rules, alerts, monitoring processes, and security controls.

• Maintain awareness of emerging threats, vulnerabilities, and relevant attack techniques.

• Bachelor’s Degree in Computer Science, Information Technology, Cybersecurity, or a related field, and two (2) to four (4) years of experience in cybersecurity, security operations, incident response, or a related field; or an equivalent combination of education and experience. Relevant certifications such as Security+, GCIH, or similar security certifications preferred.

• Experience investigating security alerts, suspicious activity, and potential security incidents.

• Experience with the following:

  • SIEM, XDR/EDR, endpoint security, DLP, network security, or similar technologies.
  • A ticketing or case-management platform such as Service Now.
  • Zscaler, Microsoft Defender, Log Rhythm, Trend Micro Vision One, or comparable security platforms.
  • Working with an MSSP or Security Operations Center.
  • DLP investigations, data protection controls, and detection-rule development.

• Familiarity with threat-hunting methodologies and the MITRE ATT&CK framework.

• Ability to work independently, manage multiple investigations, and communicate technical findings to technical and non-technical audiences.

• Excellent interpersonal, verbal, and written communication skills with the ability to communicate with courtesy and diplomacy and efficiently follow written and verbal instructions.

• Excellent organizational skills including record keeping, data collection, and system information. Ability to compile and analyze data and furnish information in report format, written…