{"id":3464765,"url":"https://alion.io/job/southern-cyber-threat-analyst","title":"Cyber Threat Analyst","company":{"id":2607898,"name":"Southern","domain":"southern.com","url":"https://alion.io/company/southern-com","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Oracle","truth_index":null},"role":"Security","role_family":"Security","seniority":"middle","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Atlanta, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":81000,"max_usd":155000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":502},"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Cyber Kill Chain","optional":false},{"name":"Linux","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Red Teaming","optional":false},{"name":"SIEM","optional":false},{"name":"Unix","optional":false},{"name":"Windows","optional":false}],"status":"live","first_seen_at":"2026-10-29T13:27:38Z","employer_posted_date":"2026-10-29","last_verified_at":"2026-11-01T07:06:10Z","board_verified":true,"closed_at":null,"days_open":2,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":2},"description":"Job Description\nA Southern Company Cyber Security Analyst supporting Threat Analysis is responsible for monitoring, investigating, documenting, and responding to cybersecurity events that may impact Southern Company systems, users, data, and operations.\nThe analyst serves as a front-line cybersecurity investigator, evaluating alerts and other security information to determine the nature, scope, and potential impact of suspicious activity. Analysts are expected to look beyond the initial alert, understand the underlying threat, identify potentially affected users or systems, evaluate possible post-compromise activity, and determine whether additional investigation, containment, or escalation is required.\nThe role requires sound investigative judgment, technical curiosity, strong documentation and communication skills, and the ability to work collaboratively with other cybersecurity teams. Analysts also contribute to the continued improvement of Threat Analysis processes, detections, investigation procedures, and overall SOC capabilities.\nCandidates are expected to discuss and demonstrate that they meet the required qualifications applicable to the role.\ndashboards, email, and other established intake channels.\nInvestigate security alerts and incidents involving endpoint, identity, network, cloud, email, and other available security telemetry.\nAnalyze the underlying activity associated with an alert to understand the potential threat, determine whether suspicious activity was successful, and identify possible follow-on or post-compromise behavior.\nScope investigations to determine whether additional users, endpoints, accounts, systems, indicators, or other assets may be affected.\nCorrelate activity across available security tools and data sources to develop a complete understanding of an investigation. Responsibilities\nMonitor and respond to cybersecurity events presented through SIEM/SOAR platforms, security tools, user submissions\nApply threat-analysis concepts and frameworks, including MITRE ATT&CK, when evaluating adversary behavior and investigation findings.\nInitiate hunting or additional investigative activity when necessary to identify potentially related or previously unidentified threats.\nTake ownership of assigned security cases from acknowledgment through appropriate resolution, escalation, or documented handoff.\nPerform approved containment or remediation activities and coordinate additional actions with appropriate stakeholders or supporting teams when required.\nEscalate security events according to established severity, incident-response, and operational escalation criteria.\nMaintain accurate and timely documentation of investigative steps, evidence, findings, decisions, containment actions, and case disposition.\nMonitor and investigate potentially malicious or suspicious email activity, including links, attachments, sender behavior, and other indicators associated with phishing or email-based threats.\nIdentify potential false positives, recurring detection issues, and opportunities to improve investigation quality or workflow efficiency.\nProvide detection and alert-tuning feedback to Detection Engineering and Automation and collaborate on opportunities to improve SOC visibility and automation.\nCollaborate with Incident Response, Detection Engineering and Automation, Threat Intelligence, Identity, Red Team, MDR partners, and other security or technology teams as required during investigations.\nParticipate in threat-analysis exercises, purple-team activities, case reviews, quality reviews, knowledge-sharing sessions, and other analyst-development activities.\nRemain current on emerging threats, adversary techniques, and security trends relevant to the Southern Company threat landscape.\nAssist with the development and maintenance of Threat Analysis procedures, playbooks, investigative guidance, and knowledge documentation.\nCommunicate investigation status, significant findings, risks, and escalation needs to shift leads, management, and other stakeholders as appropriate.\n Required Qualifications\n3-4 years of relevant experience in cybersecurity, security operations, incident investigation, threat analysis, or a related technical field.\n\nExperience and/or demonstrated knowledge in multiple areas such as endpoint analysis and response, network analysis and response, identity and authentication investigations, cloud security analysis, email and phishing analysis, Windows and/or Unix/Linux environments, command-line utilities, indicator analysis, and SIEM/SOAR or security case-management technologies.\n\nAbility to investigate security events and determine the significance, scope, and potential impact of observed activity.\n\nAbility to identify and investigate potential post-compromise activity rather than limiting analysis to the original security alert.\n\nFamiliarity with cybersecurity frameworks and concepts such as MITRE ATT&CK, NIST Cybersecurity Framework, Cyber Attack Lifecycle / Kill Chain concepts, and SANS security and incident-response methodologies.\n\nExperience documenting investigative steps and communicating technical findings clearly.\n\nAbility to take ownership of assigned investigations and appropriately engage additional resources when required.\n\nAbility to work collaboratively in a team-based security operations environment.\n\nStrong oral and written communication skills.\n\nAbility to identify, recommend, and/or perform appropriate defensive or preventive actions based on investigative findings.\n\n Preferred Capabilities\nPrevious Security Operations Center experience.\n\nExperience investigating endpoint and network security events.\n\nExperience investigating user-reported phishing, suspicious links, attachments, and email activity.\n\nExperience with packet or network traffic analysis.\n\nExperience using sandbox or malware-analysis technologies.\n\nFamiliarity with scripting or automation technologies.\n\nExperience with cloud security technologies and cloud-based investigations.\n\nExperience working with an Incident Response team during cybersecurity events or incidents.\n\nExperience using enterprise security platforms such as SIEM, SOAR, EDR/XDR, email-security, identity-security, or cloud-security technologies.\n\nAbility to correlate activity across multiple security data sources and develop an investigation timeline.\n\nAbility to understand and articulate the potential business impact associated with a cybersecurity event.\n\nAbility to recognize when an investigation requires additional technical support, containment, or escalation.\n\nExperience participating in threat hunting, purple-team exercises, tabletop exercises, or other hands-on cybersecurity scenarios.\n\nDesired Certifications\nGIAC Security Essentials (GSEC)\n\nGIAC Certified Intrusion Analyst (GCIA)\n\nSecurity+\n\nOther relevant cybersecurity certifications or industry-standard equivalents\n\nCharacteristics of a Southern Company Cyber Analyst\nSelf-Motivated - Cyber Analysts do more than respond to alerts generated by security tools. They demonstrate curiosity, investigate suspicious activity, and proactively seek the information necessary to understand a potential threat.\n\nInvestigative Mindset - Cyber Analysts seek to understand what happened, why it matters, whether the activity was successful, what else may be affected, and whether additional activity should be investigated.\n\nOwnership - Cyber Analysts take responsibility for their assigned investigations from acknowledgment through appropriate resolution, escalation, or handoff.\n\nPersistence - Cyber Analysts work through technical challenges and seek additional resources or support, when necessary, rather than allowing an investigation to stall.\n\nTeam-Oriented - Cyber Analysts operate in a collaborative environment and depend on one another for knowledge sharing, peer support, effective handoffs, and operational continuity.\n\nIntegrity - Cyber Analysts handle sensitive investigations responsibly, document findings accurately, acknowledge mistakes, and do the right thing.\n\nContinuous Learner - Cyber Analysts actively develop their technical and investigative skills and remain current on changing threats, technologies, and adversary techniques.\n\nThis position falls under the company’s Insider Threat Program and will have access to, and control over sensitive data, systems or assets. Enhanced personnel screening, which includes a background review, drug screen and psychological assessment, will be required if you are selected for this position","description_format":"text","description_chars":8515,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Energy & Utilities","Power Grid","Information Security"],"lifecycle":[{"event":"open","at":"2026-10-29T15:04:53Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":2,"expected_fill_days":16,"reasons":["conf:10","velocity","win:early"],"computed_at":"2026-11-01T06:10:25Z"},"pay":null,"html_url":"https://alion.io/job/southern-cyber-threat-analyst","json_url":"https://alion.io/job/southern-cyber-threat-analyst.json","meta":{"generated_at":"2026-11-01T10:06:04Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":15530,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-02T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2607898},"rest":"https://alion.io/mcp/rest/get_company?id=2607898"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fsouthern-cyber-threat-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fsouthern-cyber-threat-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fsouthern-cyber-threat-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/southern-cyber-threat-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fsouthern-cyber-threat-analyst"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3464765}},{"tool":"search_jobs","arguments":{"company":"southern.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3464765},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}