Cyber Threat Analyst

Southern Company•Atlanta, GA

6d•Hybrid

About The Position

A Southern Company Cyber Security Analyst supporting Threat Analysis monitors, investigates, documents, and responds to cybersecurity events that may affect company systems, users, data, or operations. The analyst serves as a front-line investigator, evaluating alerts and other security information to determine the nature, scope, and potential impact of suspicious activity. This includes investigating beyond the initial alert, identifying potentially affected users or systems, assessing possible post-compromise activity, and deciding whether further investigation, containment, or escalation is needed. The role calls for sound investigative judgment, technical curiosity, strong documentation and communication skills, and collaboration with cybersecurity teams. Analysts also help improve Threat Analysis processes, detections, investigative procedures, and SOC capabilities. The position is based at Georgia Power HQ in Atlanta, Georgia, with four days onsite and one day remote. It falls under the company’s Insider Threat Program and provides access to sensitive data, systems, or assets. Selected candidates will undergo enhanced personnel screening, including a background review, drug screen, and psychological assessment.

Requirements

3–4 years of relevant experience in cybersecurity, security operations, incident investigation, threat analysis, or a related technical field.
Experience and/or demonstrated knowledge in multiple areas such as endpoint analysis and response, network analysis and response, identity and authentication investigations, cloud security analysis, email and phishing analysis, Windows and/or Unix/Linux environments, command-line utilities, indicator analysis, and SIEM/SOAR or security case-management technologies.
Ability to investigate security events and determine the significance, scope, and potential impact of observed activity.
Ability to identify and investigate potential post-compromise activity rather than limiting analysis to the original security alert.
Familiarity with cybersecurity frameworks and concepts such as MITRE ATT&CK, NIST Cybersecurity Framework, Cyber Attack Lifecycle/Kill Chain concepts, and SANS security and incident-response methodologies.
Experience documenting investigative steps and communicating technical findings clearly.
Ability to take ownership of assigned investigations and appropriately engage additional resources when required.
Ability to work collaboratively in a team-based security operations environment.
Strong oral and written communication skills.
Ability to identify, recommend, and/or perform appropriate defensive or preventive actions based on investigative findings.

Nice To Haves

Previous Security Operations Center experience.
Experience investigating endpoint and network security events.
Experience investigating user-reported phishing, suspicious links, attachments, and email activity.
Experience with packet or network traffic analysis.
Experience using sandbox or malware-analysis technologies.
Familiarity with scripting or automation technologies.
Experience with cloud security technologies and cloud-based investigations.
Experience working with an Incident Response team during cybersecurity events or incidents.
Experience using enterprise security platforms such as SIEM, SOAR, EDR/XDR, email-security, identity-security, or cloud-security technologies.
Ability to correlate activity across multiple security data sources and develop an investigation timeline.
Ability to understand and articulate the potential business impact associated with a cybersecurity event.
Ability to recognize when an investigation requires additional technical support, containment, or escalation.
Experience participating in threat hunting, purple-team exercises, tabletop exercises, or other hands-on cybersecurity scenarios.
GIAC Security Essentials (GSEC), GIAC Certified Intrusion Analyst (GCIA), Security+, or other relevant cybersecurity certifications or industry-standard equivalents.

Responsibilities

Monitor and respond to cybersecurity events presented through SIEM/SOAR platforms, security tools, user submissions, dashboards, email, and other established intake channels.
Investigate security alerts and incidents involving endpoint, identity, network, cloud, email, and other available security telemetry.
Analyze activity associated with alerts to understand potential threats, determine whether suspicious activity was successful, and identify possible follow-on or post-compromise behavior.
Scope investigations to identify potentially affected users, endpoints, accounts, systems, indicators, or other assets.
Correlate activity across available security tools and data sources to develop a complete understanding of investigations.
Apply threat-analysis concepts and frameworks, including MITRE ATT&CK, when evaluating adversary behavior and investigation findings.
Initiate threat hunting or additional investigative activity when needed to identify related or previously unidentified threats.
Own assigned security cases from acknowledgment through resolution, escalation, or documented handoff.
Perform approved containment or remediation and coordinate additional actions with appropriate stakeholders or supporting teams.
Escalate security events according to established severity, incident-response, and operational escalation criteria.
Document investigative steps, evidence, findings, decisions, containment actions, and case disposition accurately and promptly.
Monitor and investigate potentially malicious or suspicious email activity, including links, attachments, sender behavior, and indicators associated with phishing or email-based threats.
Identify potential false positives, recurring detection issues, and opportunities to improve investigation quality or workflow efficiency.
Provide detection and alert-tuning feedback to Detection Engineering and Automation and collaborate on improving SOC visibility and automation.
Collaborate with Incident Response, Detection Engineering and Automation, Threat Intelligence, Identity, Red Team, MDR partners, and other security or technology teams during investigations as required.
Participate in threat-analysis exercises, purple-team activities, case reviews, quality reviews, knowledge-sharing sessions, and other analyst-development activities.
Stay current on emerging threats, adversary techniques, and security trends relevant to the Southern Company threat landscape.
Assist with developing and maintaining Threat Analysis procedures, playbooks, investigative guidance, and knowledge documentation.
Communicate investigation status, significant findings, risks, and escalation needs to shift leads, management, and other stakeholders as appropriate.