Senior Cyber Incident Response Lead & Investigator

att; Charlotte (NC); On-site; USD 155,000 - 233,000; Full time

Benefits offered by this job

Medical/Dental/Vision coverage

401(k) plan

Tuition reimbursement program

Paid Time Off and Holidays

Paid Parental Leave

Adoption Reimbursement

Employee discounts

Job summary

AT&T in Charlotte, NC is seeking a Principal Cybersecurity Incident Response Analyst to lead complex investigations and incident response across the enterprise. You will act as Lead Investigator for escalated incidents, coordinating with Security Operations, Digital Forensics, Threat Intelligence, and Engineering to contain, eradicate, and recover from threats.

You will mentor analysts, drive playbook improvements, and communicate at executive levels during major events, while participating in

Qualifications

• 7+ years of experience in Incident Response, Security Operations, Threat Hunting, or Digital Forensics.
• Experience leading large-scale investigations with high business impact.
• Experience developing detection logic and incident response processes.
• Experience supporting cloud-native and hybrid environments.
• Strong knowledge of threat actor behavior and incident lifecycle management.
• Industry certifications such as CISSP, GCFA, GCIA, GPEN, or equivalent.

Responsibilities

• Lead cybersecurity investigations for escalated incidents and suspicious activity.
• Serve as Lead Investigator (Handler) for all assigned escalated incidents.
• Coordinate containment, eradication, and recovery activities for major events.
• Conduct major and micro-hunt investigations to identify malicious activity.
• Investigate threats, exploits, vulnerabilities, malware, and advanced adversary activity.
• Perform advanced host, network, log, cloud, and threat intelligence analysis.
• Produce technical reports, after-action reviews, and leadership briefings.
• Collaborate with Security Operations, Threat Intelligence, Digital Forensics, and Engineering.
• Support development and improvement of incident response playbooks and automation.
• Design tabletop exercises and cybersecurity incident simulations.
• Identify security control gaps and provide recommendations.
• Mentor analysts and investigators across the Incident Response organization.
• Provide executive-level communications during significant cybersecurity events.

Skills

Incident Response

Threat Hunting

Digital Forensics

Threat Intelligence Analysis

Security Operations

SIEM (Splunk)

EDR/XDR

Cloud Security

Forensics Investigations

Scripting (Python/PowerShell)

Education

Bachelor’s degree in Computer Science or Cybersecurity

Tools

Splunk (SIEM)

EDR/XDR tooling

Threat Intelligence Platforms

Job description

AT&T in Charlotte, NC is seeking a Principal Cybersecurity Incident Response Analyst to lead complex investigations and incident response across the enterprise. You will act as Lead Investigator for escalated incidents, coordinating with Security Operations, Digital Forensics, Threat Intelligence, and Engineering to contain, eradicate, and recover from threats.

You will mentor analysts, drive playbook improvements, and communicate at executive levels during major events, while participating in