Cyber Threat Analyst

Southern Company • Atlanta, GA

13h

About The Position

A Southern Company Cyber Security Analyst supporting Threat Analysis monitors, investigates, documents, and responds to cybersecurity events that may affect company systems, users, data, and operations. The analyst evaluates alerts and other security information to determine the nature, scope, and potential impact of suspicious activity, looking beyond the initial alert to identify affected assets, assess potential post-compromise activity, and determine whether further investigation, containment, or escalation is needed.

The role calls for sound investigative judgment, technical curiosity, strong documentation and communication skills, and collaboration with cybersecurity teams. Analysts contribute to improving Threat Analysis processes, detections, investigation procedures, and SOC capabilities. The position falls under the company’s Insider Threat Program and involves access to and control over sensitive data, systems, or assets. Selected candidates will be subject to enhanced personnel screening, including a background review, drug screen, and psychological assessment.

Southern Company describes itself as an energy provider serving 9 million customers across the Southeast and beyond. Its mission is to provide clean, safe, reliable, and affordable energy with excellent service, and it is working toward net-zero greenhouse gas emissions by 2050. The company offers competitive base salary, annual incentive awards for eligible employees, and health, welfare, and retirement benefits. The position may also be eligible for additional incentive compensation, subject to applicable plan terms.

Requirements

• 3–4 years of relevant experience in cybersecurity, security operations, incident investigation, threat analysis, or a related technical field.
• Experience and/or demonstrated knowledge in multiple areas such as endpoint analysis and response, network analysis and response, identity and authentication investigations, cloud security analysis, email and phishing analysis, Windows and/or Unix/Linux environments, command-line utilities, indicator analysis, and SIEM/SOAR or security case-management technologies.
• Ability to investigate security events and determine the significance, scope, and potential impact of observed activity.
• Ability to identify and investigate potential post-compromise activity rather than limiting analysis to the original alert.
• Familiarity with cybersecurity frameworks and concepts such as MITRE ATT&CK, NIST Cybersecurity Framework, Cyber Attack Lifecycle/Kill Chain concepts, and SANS security and incident-response methodologies.
• Experience documenting investigative steps and communicating technical findings clearly.
• Ability to take ownership of assigned investigations and appropriately engage additional resources when required.
• Ability to work collaboratively in a team-based security operations environment.
• Strong oral and written communication skills.
• Ability to identify, recommend, and/or perform appropriate defensive or preventive actions based on investigative findings.

Nice To Haves

• Previous Security Operations Center experience.
• Experience investigating endpoint and network security events.
• Experience investigating user-reported phishing, suspicious links, attachments, and email activity.
• Experience with packet or network traffic analysis.
• Experience using sandbox or malware-analysis technologies.
• Familiarity with scripting or automation technologies.
• Experience with cloud security technologies and cloud-based investigations.
• Experience working with an Incident Response team during cybersecurity events or incidents.
• Experience using enterprise security platforms such as SIEM, SOAR, EDR/XDR, email-security, identity-security, or cloud-security technologies.
• Ability to correlate activity across multiple security data sources and develop an investigation timeline.
• Ability to understand and articulate the potential business impact associated with a cybersecurity event.
• Ability to recognize when an investigation requires additional technical support, containment, or escalation.
• Experience participating in threat hunting, purple-team exercises, tabletop exercises, or other hands-on cybersecurity scenarios.
• GIAC Security Essentials (GSEC), GIAC Certified Intrusion Analyst (GCIA), Security+, or other relevant cybersecurity certifications or industry-standard equivalents.

Responsibilities

• Monitor and respond to cybersecurity events through SIEM/SOAR platforms, security tools, user submissions, dashboards, email, and other established intake channels.
• Investigate security alerts and incidents involving endpoint, identity, network, cloud, email, and other available security telemetry.
• Analyze underlying activity associated with alerts to understand potential threats, determine whether suspicious activity succeeded, and identify possible follow-on or post-compromise behavior.
• Scope investigations to determine whether additional users, endpoints, accounts, systems, indicators, or other assets may be affected.
• Correlate activity across available security tools and data sources to develop a complete understanding of an investigation.
• Apply threat-analysis concepts and frameworks, including MITRE ATT&CK, when evaluating adversary behavior and investigation findings.
• Initiate threat hunting or additional investigative activity when needed to identify potentially related or previously unidentified threats.
• Own assigned security cases from acknowledgment through appropriate resolution, escalation, or documented handoff.
• Perform approved containment or remediation activities and coordinate additional actions with stakeholders or supporting teams as needed.
• Escalate security events according to established severity, incident-response, and operational escalation criteria.
• Maintain accurate and timely documentation of investigative steps, evidence, findings, decisions, containment actions, and case disposition.
• Monitor and investigate potentially malicious or suspicious email activity, including links, attachments, sender behavior, and other phishing or email-threat indicators.
• Identify potential false positives, recurring detection issues, and opportunities to improve investigation quality or workflow efficiency.
• Provide detection and alert-tuning feedback to Detection Engineering and Automation, and collaborate on improving SOC visibility and automation.
• Collaborate with Incident Response, Detection Engineering and Automation, Threat Intelligence, Identity, Red Team, MDR partners, and other security or technology teams during investigations.
• Participate in threat-analysis exercises, purple-team activities, case reviews, quality reviews, knowledge-sharing sessions, and other analyst-development activities.
• Remain current on emerging threats, adversary techniques, and security trends relevant to the Southern Company threat landscape.
• Assist with developing and maintaining Threat Analysis procedures, playbooks, investigative guidance, and knowledge documentation.
• Communicate investigation status, significant findings, risks, and escalation needs to shift leads, management, and other stakeholders as appropriate.

Benefits

• Competitive base salary
• Annual incentive awards for eligible employees
• Health, welfare, and retirement benefits designed to support physical, financial, and emotional/social well-being
• Potential eligibility for additional incentive compensation

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: No Education Listed