Cybersecurity Incident Response Lead

Southern Company; Atlanta (GA); On-site; USD 120,000 - 170,000; Full time

Job summary

Southern Company is seeking a highly experienced Cybersecurity Incident Response Analyst to act as the escalation point for cybersecurity incidents, guiding response from triage to remediation. The role involves assessing business impact, coordinating with IT security teams, and updating response procedures as threats evolve.

You will own end-to-end incident response, mentor peers, and contribute to improving detection coverage and SIEM use cases across security operations and infrastructure

Qualifications

• B.S. in Engineering, Computer Science, Cybersecurity or equivalent.
• 7+ years of cybersecurity experience, with at least 5 years in security operations center investigations of endpoint and network events.
• Advanced proficiency with SIEM, EDR, NDR, SOAR, and other cybersecurity tools.
• Experience drafting and maintaining incident response procedures.
• Ability to mentor and train cybersecurity professionals.

Responsibilities

• Take technical ownership of cybersecurity incidents end to end including triage, containment, eradication, and recovery.
• Drive collaboration across stakeholders and technical teams throughout the incident lifecycle.
• Communicate incident status, impact, and next steps to management and stakeholders.
• Document investigative actions, evidence, and findings; lead post-incident RCA.
• Lead or contribute to incident response efforts during major incidents with cross-functional collaboration.
• Track emerging threats, IOCs, and attacker TTPs; improve detection and SIEM use cases.

Skills

SIEM

EDR

NDR

SOAR

Windows

Unix/Linux

TCP/IP/DNS/HTTPS

Scripting

Cloud investigations (AWS/Azure/Google

Education

B.S. in Engineering, Computer Science, Cybersecurity

Tools

Windows utilities

Unix/Linux commands

Job description

Southern Company is seeking a highly experienced Cybersecurity Incident Response Analyst to act as the escalation point for cybersecurity incidents, guiding response from triage to remediation. The role involves assessing business impact, coordinating with IT security teams, and updating response procedures as threats evolve.

You will own end-to-end incident response, mentor peers, and contribute to improving detection coverage and SIEM use cases across security operations and infrastructure