Cybersecurity Project Attorney

Orrick, Herrington & Sutcliffe LLP; Washington (District of Columbia); On-site; USD 120,000 - 180,000; Full time

Job summary

Orrick, Herrington & Sutcliffe LLP's Cybersecurity & Incident Response group seeks a Project Attorney to work hands-on from detection through resolution, advising clients across technology, finance, life sciences and energy sectors. The role combines incident response operations with legal considerations, including breach notification analyses, regulatory reporting, and communications with stakeholders.

1–3 years in cybersecurity incident response or related privacy/data security work is

Qualifications

• 1–3 years in cybersecurity incident response, privacy law, data security, or related area.
• Superior written and verbal communication skills for presenting complex ideas to diverse audiences.
• Willingness to travel as necessary.

Responsibilities

• Triages and coordinates incident response across legal, technical, and business stakeholders.
• Analyzes breach notification laws and advises on obligations.
• Directs forensic investigations, regulatory reporting, and litigation-hold management.
• Drafts incident-related communications and client advisories.
• Supports practice operations, workflow development, and AI-enabled processes.

Skills

Incident response

Data breach response

Regulatory familiarity

Communication skills

Education

Juris Doctor (J.D.)

Job description

Overview

• The practice supports a fast-growing, internationally recognized Cybersecurity & Incident Response group, managing incidents of every scale, including some of the largest and most complex events globally.
• The role involves hands-on engagement in the operational and legal aspects of incident response from initial detection through resolution, working directly with clients ranging from emerging companies to global enterprises across technology, finance, life sciences, and energy sectors.
• Core responsibilities include triaging and coordinating incident response across legal, technical, and business stakeholders, analyzing applicable breach notification laws and advising on obligations, directing forensic investigations, managing regulatory reporting and litigation holds, and drafting incident-related communications.
• The position also involves advising on the security aspects of strategic corporate transactions, advising security teams on offensive security and darkweb intelligence gathering, and supporting clients with post-incident remediation, readiness improvements, and governance.
• Beyond incident response, the Project Attorney will have opportunities to support cybersecurity-adjacent practices, including privacy and cybersecurity litigation and enforcement, as well as privacy and AI advisory work.
• A significant portion of the role involves supporting practice operations and innovation, including developing and refining incident response workflows, integrating technology (including generative AI), digitalizing practice processes, improving client-facing solutions, and building knowledge and precedent libraries.
• Required experience includes 1-3 years in cybersecurity incident response, privacy law, data security, or a related area, with a strong preference for data breach response experience at a firm or in-house legal team.
• Candidates should possess superior written and verbal communication skills for presenting complex ideas to diverse audiences, familiarity with breach notification laws and regulatory frameworks, an understanding of incident response operational mechanics, and enthusiasm for legal technology, including AI.
• The role requires availability for travel as necessary.