Lead Insider Risk & AI-Driven Security Analyst

AT&T; Charlotte (NC); On-site; USD 141,000 - 237,000; Full time

Benefits offered by this job

Medical/Dental/Vision coverage

401(k) plan

Paid Time Off and Holidays

Parental Leave

EAP

Job summary

AT&T is seeking a Lead Cybersecurity Insider Risk Analyst to lead the response to high-priority insider risk incidents, leveraging telemetry, SIEM analytics, and automation to improve detection and response. You will coordinate across endpoints, identities, and cloud services while communicating complex findings to executives.

The role emphasizes incident leadership, detection engineering, and threat intelligence, with a focus on automation and AI-assisted analytics to boost detection fidelity

Qualifications

• 5+ years of hands-on cybersecurity experience in incident response, security operations, insider risk, or related function.
• Experience leading escalated incidents including triage, investigation, containment, remediation, and post-incident reporting.
• Proficiency with security telemetry and investigation workflows across endpoint and network data sources; experience with SIEM analytics (Splunk).
• Ability to develop automation using scripting and APIs to improve security operations.

Responsibilities

• Lead escalation handling for insider risk and cyber incidents; set investigation strategy and drive closure.
• Conduct deep-dive analyses of security events using telemetry and threat intel to determine scope and root cause.
• Develop and tune detections; reduce false positives and improve signal-to-noise.

Skills

Cybersecurity incident response

SIEM analytics

Automation scripting

Executive communication

Threat modeling

Education

Bachelor’s degree in Computer Science or Cybersecurity

Tools

Splunk

Tanium

Job description

AT&T is seeking a Lead Cybersecurity Insider Risk Analyst to lead the response to high-priority insider risk incidents, leveraging telemetry, SIEM analytics, and automation to improve detection and response. You will coordinate across endpoints, identities, and cloud services while communicating complex findings to executives.

The role emphasizes incident leadership, detection engineering, and threat intelligence, with a focus on automation and AI-assisted analytics to boost detection fidelity