Cyber Threat Analyst

Job Description

A Southern Company Cyber Security Analyst supporting Threat Analysis is responsible for monitoring, investigating, documenting, and responding to cybersecurity events that may impact Southern Company systems, users, data, and operations.

The analyst serves as a front-line cybersecurity investigator, evaluating alerts and other security information to determine the nature, scope, and potential impact of suspicious activity. Analysts are expected to look beyond the initial alert, understand the underlying threat, identify potentially affected users or systems, evaluate possible post-compromise activity, and determine whether additional investigation, containment, or escalation is required.

The role requires sound investigative judgment, technical curiosity, strong documentation and communication skills, and the ability to work collaboratively with other cybersecurity teams. Analysts also contribute to the continued improvement of Threat Analysis processes, detections, investigation procedures, and overall SOC capabilities.

Candidates are expected to discuss and demonstrate that they meet the required qualifications applicable to the role.

• dashboards, email, and other established intake channels.
• Investigate security alerts and incidents involving endpoint, identity, network, cloud, email, and other available security telemetry.
• Analyze the underlying activity associated with an alert to understand the potential threat, determine whether suspicious activity was successful, and identify possible follow-on or post-compromise behavior.
• Scope investigations to determine whether additional users, endpoints, accounts, systems, indicators, or other assets may be affected.

Correlate activity across available security tools and data sources to develop a complete understanding of an investigation. Responsibilities

• Monitor and respond to cybersecurity events presented through SIEM/SOAR platforms, security tools, user submissions
• Apply threat-analysis concepts and frameworks, including MITRE ATT&CK, when evaluating adversary behavior and investigation findings.
• Initiate hunting or additional investigative activity when necessary to identify potentially related or previously unidentified threats.
• Take ownership of assigned security cases from acknowledgment through appropriate resolution, escalation, or documented handoff.
• Perform approved containment or remediation activities and coordinate additional actions with appropriate stakeholders or supporting teams when required.
• Escalate security events according to established severity, incident-response, and operational escalation criteria.
• Maintain accurate and timely documentation of investigative steps, evidence, findings, decisions, containment actions, and case disposition.
• Monitor and investigate potentially malicious or suspicious email activity, including links, attachments, sender behavior, and other indicators associated with phishing or email-based threats.
• Identify potential false positives, recurring detection issues, and opportunities to improve investigation quality or workflow efficiency.
• Provide detection and alert-tuning feedback to Detection Engineering and Automation and collaborate on opportunities to improve SOC visibility and automation.
• Collaborate with Incident Response, Detection Engineering and Automation, Threat Intelligence, Identity, Red Team, MDR partners, and other security or technology teams as required during investigations.
• Participate in threat-analysis exercises, purple-team activities, case reviews, quality reviews, knowledge-sharing sessions, and other analyst-development activities.
• Remain current on emerging threats, adversary techniques, and security trends relevant to the Southern Company threat landscape.
• Assist with the development and maintenance of Threat Analysis procedures, playbooks, investigative guidance, and knowledge documentation.
• Communicate investigation status, significant findings, risks, and escalation needs to shift leads, management, and other stakeholders as appropriate.

Required Qualifications

• 3-4 years of relevant experience in cybersecurity, security operations, incident investigation, threat analysis, or a related technical field.

• Experience and/or demonstrated knowledge in multiple areas such as endpoint analysis and response, network analysis and response, identity and authentication investigations, cloud security analysis, email and phishing analysis, Windows and/or Unix/Linux environments, command-line utilities, indicator analysis, and SIEM/SOAR or security case-management technologies.

• Ability to investigate security events and determine the significance, scope, and potential impact of observed activity.

• Ability to identify and investigate potential post-compromise activity rather than limiting analysis to the original security alert.

• Familiarity with cybersecurity frameworks and concepts such as MITRE ATT&CK, NIST Cybersecurity Framework, Cyber Attack Lifecycle / Kill Chain concepts, and SANS security and incident-response methodologies.

• Experience documenting investigative steps and communicating technical findings clearly.

• Ability to take ownership of assigned investigations and appropriately engage additional resources when required.

• Ability to work collaboratively in a team-based security operations environment.

• Strong oral and written communication skills.

• Ability to identify, recommend, and/or perform appropriate defensive or preventive actions based on investigative findings.

Preferred Capabilities

• Previous Security Operations Center experience.

• Experience investigating endpoint and network security events.

• Experience investigating user-reported phishing, suspicious links, attachments, and email activity.

• Experience with packet or network traffic analysis.

• Experience using sandbox or malware-analysis technologies.

• Familiarity with scripting or automation technologies.

• Experience with cloud security technologies and cloud-based investigations.

• Experience working with an Incident Response team during cybersecurity events or incidents.

• Experience using enterprise security platforms such as SIEM, SOAR, EDR/XDR, email-security, identity-security, or cloud-security technologies.

• Ability to correlate activity across multiple security data sources and develop an investigation timeline.

• Ability to understand and articulate the potential business impact associated with a cybersecurity event.

• Ability to recognize when an investigation requires additional technical support, containment, or escalation.

• Experience participating in threat hunting, purple-team exercises, tabletop exercises, or other hands-on cybersecurity scenarios.

Desired Certifications

• GIAC Security Essentials (GSEC)

• GIAC Certified Intrusion Analyst (GCIA)

• Security+

• Other relevant cybersecurity certifications or industry-standard equivalents

Characteristics of a Southern Company Cyber Analyst

• Self-Motivated - Cyber Analysts do more than respond to alerts generated by security tools. They demonstrate curiosity, investigate suspicious activity, and proactively seek the information necessary to understand a potential threat.

• Investigative Mindset - Cyber Analysts seek to understand what happened, why it matters, whether the activity was successful, what else may be affected, and whether additional activity should be investigated.

• Ownership - Cyber Analysts take responsibility for their assigned investigations from acknowledgment through appropriate resolution, escalation, or handoff.

• Persistence - Cyber Analysts work through technical challenges and seek additional resources or support, when necessary, rather than allowing an investigation to stall.

• Team-Oriented - Cyber Analysts operate in a collaborative environment and depend on one another for knowledge sharing, peer support, effective handoffs, and operational continuity.

• Integrity - Cyber Analysts handle sensitive investigations responsibly, document findings accurately, acknowledge mistakes, and do the right thing.

• Continuous Learner - Cyber Analysts actively develop their technical and investigative skills and remain current on changing threats, technologies, and adversary techniques.

This position falls under the company’s Insider Threat Program and will have access to, and control over sensitive data, systems or assets. Enhanced personnel screening, which includes a background review, drug screen and psychological assessment, will be required if you are selected for this position