What does an IR specialist or Malware Analyst do at a law firm that handles ransomware and data privacy litigation?

I was talking with someone who is a partner at a law firm and specializes in ransomware and data privacy litigation. They made it seem like they have a team of analyst, incident responders, and malware analysts. What does their day to day look like? Are they contracted or full time?

analyst analysts cybersecurity data data privacy incident incident responders law litigation malware malware analyst partner privacy ransomware talking team