Incident Response Engineer

About the role

As an Incident Response Engineer, you will be responsible for supporting and enhancing the firm's cyber security incident response capabilities. Working closely with Digital and Technology colleagues and technical teams across the business, you will investigate potential security incidents, identify adversary activity, and help protect the integrity of the firm's information technology assets.

You will also contribute to the design and maintenance of incident response platforms and processes that enable rapid and effective responses to cyber security events.

What does the role involve?

• Conduct digital forensic investigations and examinations.
• Analyse files and systems for malicious activity, including malware analysis.
• Investigate potential cyber security incidents and suspected breaches.
• Anticipate threat actor behaviour and recommend appropriate countermeasures.
• Lead or support containment and recovery efforts following network intrusions.
• Document findings and present incident reports to senior stakeholders.
• Support data collection activities for client transfers and internal eDiscovery matters.
• Collaborate with technical teams to assess risks and respond to emerging threats.
• Contribute to the continuous improvement of incident response procedures, documentation, and reporting metrics.

About you

We value our culture at K&L Gates and are proud of our friendly and respectful reputation. We are looking for a likeminded individual who is able to work collaboratively in a team to get things done.

You should be practical, resilient and proactive in your approach in addition to demonstrating strong problem-solving skills, attention to detail and work well in a team.

To be successful in this role, you will bring:

• A minimum of two years' experience in a technical or cyber security-related role.
• Bachelor's degree in Information Technology, Cyber Security, Computer Science, or a related discipline.
• Hands-on experience with CrowdStrike Falcon, including Falcon Insight XDR, Real-Time Response (RTR), Identity Threat Detection, NG-SIEM, and Falcon Forensics.
• Proficiency with Microsoft Purview Insider Risk Management, including policy configuration, alert triage, case management, adaptive protection, and Activity Explorer.
• Strong understanding of UEBA (User and Entity Behaviour Analytics) concepts and behavioural indicator development.
• Experience building and tuning insider threat detection use cases and risk scoring frameworks.
• Proficiency in digital forensics across endpoint, network, email, and cloud, on Windows, macOS, and Linux.
• Familiarity with forensic tools such as EnCase, FTK, X-Ways, Axiom, or Velociraptor.
• Knowledge of DLP (Data Loss Prevention) integration with insider threat workflows.
• Ability to correlate endpoint, identity, email, and cloud signals to identify insider risk patterns.
• Experience coordinating with Legal, HR, Privacy, and Compliance stakeholders during insider investigations.
• Understanding of legal hold procedures, chain-of-custody documentation, and evidence handling standards.
• Knowledge of regulatory and compliance frameworks such as GDPR, ISO 42001, and ISO 2700.