Incident Response & Forensic Analyst I

What You’ll Do

• Are you passionate about uncovering cyber threats, investigating complex security incidents, and protecting organizations from evolving risks?

• As an Incident Response and Forensics Analyst I, you’ll play a critical role within the Security Governance team, supporting the organization's mission to safeguard people, systems, and data from cyber and physical threats. Reporting to the Director of Cyber Security Architecture and Forensics, you will work alongside incident responders, threat hunters, and security specialists to investigate threats, conduct forensic analyses, and strengthen the organization’s overall security posture.

• This is an opportunity to contribute to high-impact investigations, collaborate across teams, and help drive rapid, effective responses to security incidents while protecting the integrity of critical business operations.

• Threat Intelligence: Monitor, manage, and investigate cyber threats using third-party threat intelligence platforms to identify risks affecting the organization, industry, and key stakeholders.

• Digital Forensics: Conduct forensic investigations using industry-standard tools such as Forensic Toolkit (FTK), EnCase, and similar technologies while maintaining the integrity and admissibility of evidence.

• Incident Response: Serve as a core member of the Computer Incident Response Team (CIRT), supporting the identification, containment, investigation, and recovery of security incidents.

• Threat Hunting: Participate in and help coordinate third-party red team and purple team exercises to proactively identify vulnerabilities and strengthen defenses.

• Sensitive Investigations: Conduct investigations involving insider threats, highly sensitive matters, human resources-related events, and other complex security incidents when required.

• Security Operations Support: Provide advanced support to Security Operations teams by reviewing security events, identifying root causes, and guiding escalation and remediation efforts.

• Data Analysis & Scripting: Leverage scripting languages and data analysis tools to examine large datasets, logs, and unstructured information to support investigations and threat analysis.

• Incident Leadership: Lead assigned activities during active incidents, ensuring proper evidence preservation, response procedures, and cross-functional coordination.

• Damage Assessment & Reporting: Assist with cause-and-origin investigations, perform forensic analysis of affected systems, and deliver clear technical and investigative reports to leadership.

• Collaboration & Communication: Coordinate with internal stakeholders and external partners to ensure effective communication, timely response, and successful resolution of security events.

• Risk Identification & Remediation: Identify cybersecurity risks, indicators of compromise, and remediation opportunities while supporting corrective action efforts.

• Quality & Continuous Improvement: Participate in peer reviews, condition assessments, and ongoing improvements to incident response and forensic processes.

• Operational Readiness: Manage competing priorities independently, respond effectively under tight timelines, and provide support outside standard business hours when incident response needs arise.

What You’ll Bring

• Education & Certifications: Bachelor’s degree in Cybersecurity or a related field preferred. Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), or similar technical certifications are preferred.
• Relevant

Experience

• At least five years of experience in information technology operations and/or engineering, including a minimum of three years focused on cybersecurity, compliance, risk management, or security technology implementation.
• Security Framework Knowledge: Familiarity with industry standards and frameworks such as International Organization for Standardization 27001 (ISO 27001), National Institute of Standards and Technology Special Publication 800-53 (NIST 800-53), Cybersecurity Framework (CSF), Center for Internet Security Controls (CIS), and MITRE ATT&CK.
• Technical Security Expertise: Hands-on experience with Security Information and Event Management (SIEM), endpoint security platforms, Network Intrusion Prevention Systems and Intrusion Detection Systems (IPS/IDS), privileged access management, vulnerability management, data loss prevention, and next-generation firewalls.
• Cloud Security Knowledge: Experience securing Microsoft 365 (M365) environments, Azure Infrastructure as a Service (IaaS), Azure Platform as a Service (PaaS), Cloud Access Security Broker (CASB), Cloud Security Posture Management (CSPM), and web application security technologies.
• Forensic & Investigation

Skills

• Strong understanding of forensic methodologies, evidence handling, incident investigation, threat analysis, and adversary tactics, techniques, and procedures.

• Communication & Influence: Ability to communicate technical and non-technical concepts effectively through presentations, documentation, reports, and stakeholder discussions.

• Problem Solving & Decision Making: Strong analytical thinking, sound judgment, and the ability to develop practical solutions in high-pressure situations.

• Leadership & Collaboration: Proven ability to guide teams, influence outcomes, foster collaboration, and contribute to complex initiatives across multiple stakeholder groups.

• Integrity & Confidentiality: Demonstrated commitment to handling sensitive information with discretion while maintaining the highest standards of ethics, professionalism, and trust.

• If you’re excited to investigate sophisticated cyber threats, strengthen incident response capabilities, and make a meaningful impact as an Incident Response and Forensics Analyst I, we’d love to hear from you!

Compensation

The base salary range below represents the low and high end of the salary range for this position in Chicago. This range may differ based on your geographic location and cost of living considerations. At Kirkland & Ellis, we consider compensation more than just a base salary. We offer an exceptional range of flexible benefits including comprehensive healthcare, paid time off, and retirement. We also offer personal support and tailored learning and development opportunities all designed to help you realize your full potential both in life and at work.

Compensation Range:

Chicago: $130,000 - $144,000