Cyber Threat Analyst

Location: Atlanta, GA, United States

Cyber Threat Analyst

Location: Georgia Power HQ - Atlanta, GA.

4 days onsite/ 1 day remote. 

A Southern Company Cyber Security Analyst supporting Threat Analysis is responsible for monitoring, investigating, documenting, and responding to cybersecurity events that may impact Southern Company systems, users, data, and operations.

The analyst serves as a front-line cybersecurity investigator, evaluating alerts and other security information to determine the nature, scope, and potential impact of suspicious activity. Analysts are expected to look beyond the initial alert, understand the underlying threat, identify potentially affected users or systems, evaluate possible post-compromise activity, and determine whether additional investigation, containment, or escalation is required.

The role requires sound investigative judgment, technical curiosity, strong documentation and communication skills, and the ability to work collaboratively with other cybersecurity teams. Analysts also contribute to the continued improvement of Threat Analysis processes, detections, investigation procedures, and overall SOC capabilities.

Candidates are expected to discuss and demonstrate that they meet the required qualifications applicable to the role.

• dashboards, email, and other established intake channels.
• Investigate security alerts and incidents involving endpoint, identity, network, cloud, email, and other available security telemetry.
• Analyze the underlying activity associated with an alert to understand the potential threat, determine whether suspicious activity was successful, and identify possible follow-on or post-compromise behavior.
• Scope investigations to determine whether additional users, endpoints, accounts, systems, indicators, or other assets may be affected.

Correlate activity across available security tools and data sources to develop a complete understanding of an investigation. Responsibilities

• Monitor and respond to cybersecurity events presented through SIEM/SOAR platforms, security tools, user submissions
• Apply threat-analysis concepts and frameworks, including MITRE ATT&CK, when evaluating adversary behavior and investigation findings.
• Initiate hunting or additional investigative activity when necessary to identify potentially related or previously unidentified threats.
• Take ownership of assigned security cases from acknowledgment through appropriate resolution, escalation, or documented handoff.
• Perform approved containment or remediation activities and coordinate additional actions with appropriate stakeholders or supporting teams when required.
• Escalate security events according to established severity, incident-response, and operational escalation criteria.
• Maintain accurate and timely documentation of investigative steps, evidence, findings, decisions, containment actions, and case disposition.
• Monitor and investigate potentially malicious or suspicious email activity, including links, attachments, sender behavior, and other indicators associated with phishing or email-based threats.
• Identify potential false positives, recurring detection issues, and opportunities to improve investigation quality or workflow efficiency.
• Provide detection and alert-tuning feedback to Detection Engineering and Automation and collaborate on opportunities to improve SOC visibility and automation.
• Collaborate with Incident Response, Detection Engineering and Automation, Threat Intelligence, Identity, Red Team, MDR partners, and other security or technology teams as required during investigations.
• Participate in threat-analysis exercises, purple-team activities, case reviews, quality reviews, knowledge-sharing sessions, and other analyst-development activities.
• Remain current on emerging threats, adversary techniques, and security trends relevant to the Southern Company threat landscape.
• Assist with the development and maintenance of Threat Analysis procedures, playbooks, investigative guidance, and knowledge documentation.
• Communicate investigation status, significant findings, risks, and escalation needs to shift leads, management, and other stakeholders as appropriate.

About Us

About the Organization