{"id":2139594,"url":"https://alion.io/job/southern-cybersecurity-incident-response-analyst","title":"Cybersecurity Incident Response Analyst","company":{"id":2607898,"name":"Southern","domain":"southern.com","url":"https://alion.io/company/southern-com","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Oracle","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Atlanta, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":106000,"max_usd":206000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":1245},"experience_years_min":7,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"DNS","optional":false},{"name":"GCP","optional":false},{"name":"Linux","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"NIST CSF","optional":false},{"name":"SIEM","optional":false},{"name":"TCP/IP","optional":false},{"name":"Unix","optional":false},{"name":"Windows","optional":false}],"status":"live","first_seen_at":"2026-10-06T12:14:41Z","employer_posted_date":"2026-10-06","last_verified_at":"2026-10-18T19:16:40Z","board_verified":true,"closed_at":null,"days_open":12,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":12},"description":"Cybersecurity Incident Response Analyst\nJob Description\nSouthern Company is seeking a highly experienced Cybersecurity Incident Response Analyst. In this role, you will be the escalation point for cybersecurity incidents and lead response efforts from initial triage through containment, eradication, and remediation. You will assess potential business impacts (including reputational and financial risk), partner with other IT security teams during investigations, and stay current on the evolving threat landscape to improve detection and response capabilities. When not actively responding to incidents, you will proactively update procedures, investigate suspicious cyber events, and make recommendations to improve overall cybersecurity and hygiene.\nResponsibilities\nTake technical ownership of cybersecurity incidents end to end including triage, containment, eradication, and recovery\n\nDrive collaboration across stakeholders and technical teams throughout the incident lifecycle, including investigation, containment, mitigation, and remediation; clearly articulate investigative requirements, secure necessary evidence, and identify when additional resources or specialized support are required.\n\nCommunicate incident status, impact, and next steps to management and key stakeholders\n\nDocument investigative actions, evidence, and findings\n\nLead post-incident root cause analysis and lessons learned\n\nServe as an escalation point for security monitoring teams by conducting detailed analysis of escalated alerts and security events; leverage telemetry, forensic evidence, and stakeholder input to determine incident severity, scope, and required response actions.\n\nPerform endpoint and network forensics using forensically sound acquisition and evidence handling procedures\n\nConduct self-initiated investigations to identify potential breaches or undiscovered threats\n\nTrack and communicate emerging threats, IOCs, and attacker TTPs from your investigations; recommend and help implement detective/protective improvements\n\nApply lessons learned from incident investigations to improve detection coverage, refine alerting logic, and strengthen SIEM use cases in collaboration with detection engineering and security operations teams.\n\nWrite technical articles and share knowledge to improve team effectiveness and repeatability\n\nBuild and maintain strong working relationships across cybersecurity, infrastructure support teams, and business unit operations centers\n\nQualifications\nB.S. in Engineering, Computer Science, Cybersecurity, or equivalent\n\n7+ years of cyber security experience, at least 5 in a security operations center investigating endpoint and network security events\n\nAdvanced proficiency with SIEM, EDR, NDR, SOAR, and other cybersecurity tools\n\nAdvanced knowledge, experience, and proficiency with several of the following:\nOperating systems fundaments in Windows and Unix/Linux\n\nNetworking fundamentals such as TCP/IP, DNS, HTTPS, routing, firewalls\n\nScripting languages\n\nWindows/Unix command-line utilities\n\nCloud investigations in AWS, Azure, Google Cloud, and Oracle Cloud\n\nExperience drafting and maintaining incident response procedures\n\nExperience leading and/or contributing to incident response efforts during major cybersecurity incidents, including cross-functional collaboration and stakeholder communication.\n\nDemonstrated ability to build partnerships across security, IT, engineering, operations, and business teams to achieve shared outcomes during incident response activities.\n\nStrong collaboration, communication, and stakeholder-management skills with a team-first approach to solving complex problems.\n\nProven ability to influence without authority and drive consensus during high-pressure incidents.\n\nKnowledge of common cybersecurity frameworks (e.g., NIST CSF, MITRE ATT&CK, SANS Security Controls)\n\nAbility to effectively communicate cybersecurity risks, technical findings, and business impacts across all organizational levels, from technical staff to executive leadership.\n\nDemonstrated ownership of incident investigations from discovery through recovery\n\nExperience mentoring and training other cyber security professionals\n\nWilling and able to obtain a US government security clearance to support threat investigations\n\nDesire to develop competency in OT cybersecurity and incident response in industrial environments\n\nDesired Certifications\nGIAC Certified Incident Handler (GCIH)\n\nGIAC Certified Intrusion Analyst (GCIA)\n\nGIAC Certified Forensics Examiner (GCFE)\n\nOffensive Security Certified Professional (OSCP)\n\nThis position falls under the company’s Insider Threat Program and will have access to, and control over sensitive data, systems or assets. Enhanced personnel screening, which includes a background review, drug screen and psychological assessment, will be required if you are selected for this position","description_format":"text","description_chars":4875,"description_truncated":false,"requirements":{"experience_years_min":7,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":true},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security","Incident Response","Energy & Utilities"],"lifecycle":[{"event":"open","at":"2026-10-09T02:53:40Z"}],"visa":[],"liveness":{"score":61,"band":"ok","label":"Likely open","p_open":1,"p_active":0.807,"p_room":0.75,"age_days":10,"expected_fill_days":14,"reasons":["conf:3","velocity","win:late"],"computed_at":"2026-10-17T05:46:00Z"},"pay":null,"html_url":"https://alion.io/job/southern-cybersecurity-incident-response-analyst","json_url":"https://alion.io/job/southern-cybersecurity-incident-response-analyst.json","meta":{"generated_at":"2026-10-19T02:32:03Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":1400,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-20T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2607898},"rest":"https://alion.io/mcp/rest/get_company?id=2607898"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fsouthern-cybersecurity-incident-response-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fsouthern-cybersecurity-incident-response-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fsouthern-cybersecurity-incident-response-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/southern-cybersecurity-incident-response-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fsouthern-cybersecurity-incident-response-analyst"}]}