Cybersecurity Analyst

KAHANA & FELD LLP; California; Hybrid; USD 90,000 - 130,000; Full time

Job summary

KAHANA & FELD LLP is seeking a Cybersecurity Analyst to protect the firm’s systems, networks, and confidential information. You will monitor security tools, investigate alerts, support incident response, and coordinate client security questionnaires with the CIO and infrastructure teams.

The role requires at least 2 years in information security, hands-on MS 365 security experience, and knowledge of threat controls, vulnerability management, and compliance frameworks.

Qualifications

• Associate’s or Bachelor’s degree in cybersecurity, IT, CS, or related field, or equivalent professional experience.
• 0
• Minimum 2 years of information security experience in a law firm.
• Hands-on experience with Microsoft 365 security and Entra ID, Intune, Defender, Azure, or comparable platforms.
• Knowledge of network, identity, endpoint, and email security; vulnerability management; patching; encryption; and backup protection.
• Experience completing client security questionnaires and maintaining control documentation.

Responsibilities

• Implement, operate, and document security controls under firm policies, standards, procedures, and change-management requirements.
• Monitor security alerts, logs, dashboards, and managed security service notifications; triage events and escalate as needed.
• Support incident response through evidence collection, investigation, containment, and remediation tracking.
• Run or coordinate vulnerability scans and track corrective actions.
• Maintain endpoint, network, cloud, identity, email, web, and data-protection controls.
• Assist with security tools for EDR, event monitoring, MFA, and DLP.
• Support access reviews and joiner-mover-leaver controls and investigate sign-in activity.
• Complete client security questionnaires and coordinate accurate responses.
• Maintain library of approved questionnaire responses, control docs, policies, and evidence.
• Track findings and follow up with owners until closure.
• Assist with third-party security reviews and phishing simulations.
• Maintain security documentation and metrics.
• Stay current on threats and vulnerabilities relevant to law firms.

Skills

Information security

Microsoft 365 security

Vulnerability management

Audit evidence

Security questionnaires

NIST CSF

SOC 2 / ISO 27001

Alert investigation

Security certifications

Education

Bachelor’s degree in cybersecurity/IT/CS or related field

Job description

Description

The Cybersecurity Analyst will perform the day-to-day work required to protect the firm’s systems, networks, applications, and confidential information. This role will monitor security tools, investigate alerts, support incident response and remediation, work with the CIO to complete client security questionnaires, maintain documentation, and work closely with the infrastructure team.

Duties and Responsibilities

• Implement, operate, and document security controls under approved firm policies, standards, procedures, and change‑management requirements.
• Monitor security alerts, logs, dashboards, and managed security service notifications; triage events, document findings, and escalation issues under established procedures.
• Support incident response through evidence collection, investigation, containment, user coordination, documentation, and remediation tracking.
• Run or coordinate vulnerability scans, validate findings, assign remediation tasks, and track corrective actions through closure.
• Work with the infrastructure and applications teams to maintain endpoint, network, cloud, identity, email, web, and data‑protection controls.
• Assist with security tools for endpoint detection and response, event monitoring, email protection, multifactor authentication, mobile device management, and data loss prevention.
• Support user and privileged access reviews, joiner‑mover‑leaver controls, and investigation of unusual sign‑in activity.
• Complete client and prospective‑client security questionnaires by gathering current information and coordinating accurate, consistent, and timely responses.
• Maintain an organized library of approved questionnaire responses, control descriptions, supporting evidence, policies, certifications, and other due‑diligence materials.
• Track findings from audits, tests, assessments, client reviews, and incidents, and follow up with assigned owners until completion.
• Support third‑party security reviews by collecting questionnaires, reviewing available documentation, recording findings, and escalating concerns.
• Assist with phishing simulations, security awareness communications, user training, and follow‑up coaching for employees who need additional guidance.
• Maintain operating procedures, system records, incident notes, knowledge base articles, metrics, and other security documentation.
• Stay current on relevant threats, vulnerabilities, product updates, and other law‑firm security concerns.
• Perform other assigned security duties.

Qualifications & Skills

• Associate’s or Bachelor’s degree in cybersecurity, information technology, computer science, or a related field, or equivalent professional experience, is required.
• Minimum of 2 years of information security, cybersecurity, or security‑focused information technology experience supporting a law firm.
• Hands‑on experience with Microsoft 365 security and technologies such as Entra ID, Intune, Defender, Azure, or comparable platforms.
• Working knowledge of network, identity, endpoint, and email security; vulnerability management; patching; encryption; and backup protection.
• Experience completing client security questionnaires, collecting audit evidence, maintaining control documentation, or supporting security and compliance reviews.
• Familiarity with the NIST Cybersecurity Framework, CIS Controls, ISO 27001, SOC 2, or comparable security requirements.
• Ability to investigate alerts using logs, endpoint detection and response tools, event monitoring systems, vulnerability scanners, or managed security providers.
• Strong attention to detail, documentation, written communication, organization, and follow‑through, with the ability to manage multiple assigned tasks and deadlines.
• Sound judgment, discretion, and a service‑oriented approach when handling confidential information; Security+, SSCP, or a comparable certification is preferred but not required.

This job description reflects management’s assignment of essential functions; it does not prescribe or restrict the tasks that may be assigned.

Equal Opportunity Employer

Kahana Feld provides equal employment opportunities to all employees and applicants for employment and prohibits discrimination and harassment of any type without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws.

This policy applies to all terms and conditions of employment, including recruiting, hiring, placement, promotion, termination, layoff, recall, transfer, leaves of absence, compensation and training.

Job Type

Full‑Time

Supervisory Responsibilities

None

Work Location

Hybrid or Remote

Physical Requirements

Primarily sedentary work. Exerting up to 40 pounds of force occasionally and/or negligible amount of force frequently or constantly to lift, carry, push, pull or otherwise move objects. Repetitive motion. Substantial movements (motions) of the wrists, hands, and/or fingers. The worker is required to have close visual acuity to perform an activity such as: preparing and analyzing data and figures; transcribing; viewing a computer terminal; extensive reading. Work is performed in an office environment and requires the ability to operate standard office equipment and keyboards. Must have the ability to walk short distances, and/or drive a vehicle to deliver and pick up materials. Work can be performed with or without accommodations.

Travel

Up to 10% domestic travel by ground and/or air, dependent on firm needs.