Project Attorney, Cybersecurity

Orrick currently has an excellent opportunity for a Cybersecurity Project Attorney with 1-3 years experience based in Orrick Analytics. This position could be based in any of our U.S. offices and consideration given for 100% remote US locations.

The Cybersecurity Project Attorney will support the fast-growing and internationally recognized Cybersecurity & Incident Response practice. This is a hands-on role focused on the operational and legal mechanics of incident response, offering the opportunity to develop deep expertise in one of the most dynamic areas of law while working closely with seasoned practitioners on high-profile matters.

Our team manages cybersecurity incidents of every scale—including some of the largest and most complex events in history—from initial detection through resolution.

• Triaging and coordinating the response to security incidents across legal, technical, and business stakeholders
• Analyzing applicable breach notification laws and advising on notification obligations and timelines
• Advising on the security aspects of strategic corporate transactions
• Advising security teams on the nascent legal landscape of offensive security and darkweb intelligence gathering
• Directing and coordinating forensic investigations, including scoping engagements and liaising with forensic vendors
• Assessing and managing regulatory reporting obligations, litigation holds, and related risk during active incidents
• Drafting and reviewing incident-related communications, including notification letters, public statements, and internal updates
• Conducting data impact assessments and supporting clients with post-incident remediation, readiness improvements, and governance

The successful candidate will work with clients ranging from emerging companies to global enterprises across the technology, finance, life sciences and energy sectors.

As a Project Attorney on the team, you will be embedded in live incident response engagements from the outset—supporting triage, fact development, regulatory analysis, client communications, forensic coordination, and breach notification workflows. You will receive hands-on training and mentorship and will have direct client exposure as you grow into the role.

While the primary focus of this role is incident response, a Project Attorney will also have the opportunity to support cybersecurity-adjacent practices, including privacy and cybersecurity litigation and enforcement, as well as privacy and AI advisory work.

Practice Operations and Innovation: In addition to substantive incident response work, the Cybersecurity Project Attorney will support projects to operationalize and improve the practice’s incident response capabilities, including:

• Developing and refining incident response workflows, intake and triage processes, and standard operating procedures to streamline the delivery of legal services during active incidents
• Understanding the firm’s available resources and technology, and developing best practices and other programs to drive teams and tasks to the “right” resources (whether people, process, or technology)
• Working on projects to digitalize the practice, including automation, data capture and use of online resources
• Supporting the firm’s data strategy, including tracking matter data, monitoring usage of practice content and resources, and capturing experience data
• Support, coordinate, and lead projects to integrate technology, including generative AI, into the practice of law, including:
• Vetting, piloting, and supporting the onboarding of technology to support the legal practice
• Support, coordinate, and lead projects to develop and improve client-facing solutions, including:
• Designing and improving solutions to share matter metrics, data, and regulatory insights with clients and teams
• Capturing and leveraging matter, experience, and regulatory data to improve and inform future incident response engagements
• Creating and automating knowledge and precedent libraries, including notification templates, regulatory reference materials, jurisdictional analysis tools, and response checklists
• Identifying relevant practice content in collaboration with the firm’s Research & Information team, including third-party resources and forms, and integrating them into practice workflows
• Identifying additional areas of opportunity for practice content and knowledge sharing and creation, and process improvements
• Evaluating the efficient delivery of incident response legal services through internal data, external benchmarking, and market trend monitoring, and identifying opportunities to improve client service
• Educating lawyers and legal professionals on incident response tools, firm resources, technology, and other initiatives to improve legal services
• Communicating and consulting with attorneys, paralegals, and staff on efficiency, client solutions, and technology projects related to the practice
• Developing and maintaining case studies and innovation materials to support marketing and business development for the practice

• Juris doctorate (J.D.) from an accredited university or college and admission to practice in good standing in a US jurisdiction required.
• One to three years of experience in cybersecurity incident response, privacy law, data security, or a related area of practice. Experience at a firm or in-house legal team handling data breach response is strongly preferred.
• Superior written and verbal communication skills with demonstrated ability to present complex ideas to attorneys, managers, clients, and the public in layman’s terms.
• Ability to solve practical problems and deal with a variety of concrete variables in situations where only limited standardization and/or specific direction exists.
• Familiarity with breach notification laws, regulatory frameworks, and best practices for incident response workflows and documentation.
• Understanding of the operational mechanics of incident response, including forensic investigations, regulatory reporting, and breach notification processes.
• Familiarity with and enthusiasm about legal technology, including opportunities to leverage AI and generative AI in legal services.
• Excellent analytical, project management, prioritization, and organization skills.
• Self-starter with the ability to work independently with good judgment, handle multiple tasks simultaneously, and quickly prioritize projects.
• Ability to work collaboratively at all organizational levels.
• Flexible team player with ability to approach problems with a sense of ownership, enthusiasm, and innovation.
• Strong interpersonal skills and the ability to communicate clearly and effectively with clients, forensic vendors, and internal teams under time-sensitive conditions.
• Availability to travel as necessary.
• Desire and ability to work beyond the position’s written duties and assist on other projects and initiatives, as needed.

Why Orrick:

At our core, we value collegiality among our lawyers and strive to make our practices both professionally and personally rewarding. We'll help you to connect with peers and mentors to ensure you are integrated into our client teams. Our top-notch training and mentoring programs, retreats and academies, and shadowing opportunities are what set us apart. If you are passionate about innovative work in a dynamic environment, you're just who we've been looking for.

Compensation and Benefits

The expected salary range for this position is:

• New York City, Silicon Valley, and San Francisco $150,000 - $225,000
• Washington DC, Los Angeles, Orange County, Santa Monica, Sacramento, Boston, and Seattle $150,000 - $225,000
• All Other US Locations $150,000 - $200,000

Orrick is committed to providing a comprehensive, competitive, and thoughtful total compensation package to our attorneys and staff, wherever they work. This compensation and benefits information is based on the Orrick’s estimate as of the date of publication and may be modified in the future. The level of pay within the range will depend on a variety of job-related factors that may include, but not limited to, qualifications, relevant experience or education, particular skills or expertise, geography.   Other compensation may include an annual discretionary merit bonus, which would be determined by Firm and individual performance.  

We offer a full range of elective health benefits including medical, dental, vision and life; robust mental well-being programs; child, family, elder, and pet care benefits; short- and long-term disability and industry leading parental leave benefits; health savings account contributions (w/applicable medical plan), flexible spending accounts, and a 401K program. This role will receive compensated time off through our Flexible Time Off program and paid holidays. 

Orrick accepts applications for this position on an ongoing basis, until filled.

We are an Equal Opportunity Employer.

Consistent with the SF Fair Chance Ordinance, an arrest and conviction record will not automatically disqualify a qualified applicant from consideration for employment. For attorney positions, a 'qualified applicant' is an individual who is a member of the State Bar of California, admitted in good standing, and is eligible to practice[1]; or whose admission to the State Bar of California and eligibility to practice remains subject only to successful completion of the California Bar Examination.

Qualified applicants with criminal histories will be considered for the position in a manner consistent with the requirements of the Los Angeles Fair Chance Initiative for Hiring.