Senior Incident Response Analyst - Cybersecurity Forensics

Southern Company; Atlanta (GA); Hybrid; USD 120,000 - 180,000; Full time

Job summary

Southern Company is seeking an experienced Cybersecurity Incident Response Analyst to lead incidents from triage to remediation. You will assess business impacts, partner with IT security teams, and continuously improve detection and response capabilities through procedures and knowledge sharing.

You will own investigations, communicate with executives and stakeholders, and drive post-incident analyses to strengthen defenses across cybersecurity operations, incident response, and threat intel

Qualifications

• Bachelor's degree in Engineering, Computer Science, Cybersecurity, or equivalent.
• 7+ years of cybersecurity experience, with 5+ in a security operations center investigating endpoint and network security events.
• Advanced proficiency with SIEM, EDR, NDR, SOAR, and other cybersecurity tools.
• Experience drafting and maintaining incident response procedures; able to lead IR efforts and communicate with stakeholders.
• Ability to build partnerships across security, IT, engineering, and operations to achieve shared outcomes.

Responsibilities

• Take technical ownership of cybersecurity incidents end to end including triage, containment, eradication, and recovery.
• Drive collaboration across stakeholders and technical teams throughout the incident lifecycle and secure evidence.
• Communicate incident status, impact, and next steps to management and stakeholders.
• Document investigative actions, evidence, and findings.
• Lead post-incident root cause analysis and lessons learned.
• Serve as escalation point for security monitoring teams, analyzing escalated alerts and events.
• Perform endpoint and network forensics with proper evidence handling.
• Track emerging threats, IOCs, and attacker TTPs; implement detective/protective improvements.
• Apply lessons learned to improve detection and SIEM use cases.
• Write technical articles to improve team effectiveness.
• Build relationships across cybersecurity, infrastructure, and business units.

Skills

SIEM

EDR

NDR

SOAR

Windows

Unix/Linux

Cloud forensics

Incident response

Security investigations

Education

B.S. in Engineering

Job description

Southern Company is seeking an experienced Cybersecurity Incident Response Analyst to lead incidents from triage to remediation. You will assess business impacts, partner with IT security teams, and continuously improve detection and response capabilities through procedures and knowledge sharing.

You will own investigations, communicate with executives and stakeholders, and drive post-incident analyses to strengthen defenses across cybersecurity operations, incident response, and threat intel