Hybrid Cyber Threat Analyst – Investigations & Hunting

AbilityLinks; Atlanta (GA); Hybrid; USD 80,000 - 120,000; Full time

Job summary

Southern Company Services in Atlanta, GA is seeking a Cyber Security Analyst in Threat Analysis to monitor, investigate, document, and respond to cybersecurity events affecting systems, users, data, and operations. You will evaluate alerts using MITRE ATT&CK, coordinate with SOC teams, perform containment and escalation, and contribute to playbooks and knowledge bases.

This role requires strong investigative judgment, documentation, and collaboration across Incident Response, Threat

Qualifications

• 3–4 years in cybersecurity, security operations, or incident investigation.
• Experience with endpoint, network, identity and cloud investigations.
• Ability to assess risk, scope, and impact of observed activity.
• Familiarity with MITRE ATT&CK, NIST CSF, and kill chain concepts.
• Strong written and oral communication; collaborative work style.

Responsibilities

• Monitor and respond to cybersecurity events via SIEM/SOAR and other tools.
• Investigate alerts across endpoints, identity, network, and cloud telemetry.
• Analyze activity behind alerts to determine threat level and next steps.
• Scope investigations to identify affected users, endpoints, or assets.
• Correlate data across sources to build a full investigation timeline.
• Escalate and coordinate containment or remediation with stakeholders.
• Document steps, findings, and disposition clearly and timely.
• Collaborate with Incident Response, Threat Intel, and MDR partners.

Skills

Threat analysis

Investigation

Documentation

Communication

Team collaboration

Education

Bachelor's degree in Cybersecurity

GIAC/GSEC certification preferred

Tools

SIEM/SOAR

EDR/XDR tools

Cloud security tools

Job description

Southern Company Services in Atlanta, GA is seeking a Cyber Security Analyst in Threat Analysis to monitor, investigate, document, and respond to cybersecurity events affecting systems, users, data, and operations. You will evaluate alerts using MITRE ATT&CK, coordinate with SOC teams, perform containment and escalation, and contribute to playbooks and knowledge bases.

This role requires strong investigative judgment, documentation, and collaboration across Incident Response, Threat