Principal Cybersecurity - Incident Response Analyst

The Principal Cybersecurity Incident Response Analyst is responsible for leading complex cybersecurity investigations and incident response activities across AT&T's enterprise environment. This role serves as the Lead Investigator for escalated security incidents, partnering closely with Security Operations, Digital Forensics, Threat Intelligence, Malware Analysis, Engineering, and business stakeholders to identify, contain, eradicate, and recover from cybersecurity threats.

The Principal Analyst provides expert-level technical leadership during significant cybersecurity incidents, conducts proactive threat hunting activities, and drives continuous improvement of incident response processes, detection capabilities, and investigative methodologies. This position requires strong investigative skills, deep technical expertise, executive-level communication abilities, and the ability to mentor others across the Incident Response organization.

This role participates in an on-call rotation and supports investigations involving endpoint systems, cloud environments, identity platforms, network infrastructure, telecommunications systems, applications, and emerging technologies.

• Lead cybersecurity investigations associated with escalated security incidents and suspicious activity.
• Serve as Lead Investigator (Handler) for all assigned escalated cybersecurity incidents.
• Coordinate and oversee all investigative, containment, eradication, and recovery activities associated with major cybersecurity events.
• Conduct major and micro-hunt investigations to identify malicious activity, assess risk, and improve organizational detection capabilities.
• Investigate threats, exploits, vulnerabilities, malware families, and advanced adversary activity across enterprise environments.
• Perform advanced host, network, log, cloud, and threat intelligence analysis.
• Produce technical reports, after-action reviews, executive summaries, and leadership briefings documenting investigative findings and recommendations.
• Collaborate with Security Operations, Threat Intelligence, Digital Forensics, Malware Analysis, Engineering, Legal, Privacy, and other stakeholders during active investigations.
• Support the development and continuous improvement of incident response playbooks, processes, automation, and investigative methodologies.
• Design and facilitate tabletop exercises and cybersecurity incident simulations.
• Identify security control gaps and provide recommendations to improve organizational resilience.
• Mentor analysts and investigators throughout the Incident Response organization in both technical and professional development areas.
• Provide executive-level communications during significant cybersecurity events.

Experience or working knowledge in several of the following areas:

• Cyber Incident Response
• Threat Hunting
• Digital Forensics
• Threat Intelligence Analysis
• Security Operations
• SIEM Technologies (Splunk or equivalent)
• Endpoint Detection and Response (EDR/XDR)
• Cloud Security (AWS, Azure, and SaaS platforms)
• Host and Network Forensics
• Malware Analysis Fundamentals
• Vulnerability Assessment and Exploitation Techniques
• Intrusion Detection and Anomaly Detection
• Security Alert Design and Detection Engineering
• Network Protocol Analysis
• Windows, Linux, and macOS Investigations
• Threat Actor Tactics, Techniques, and Procedures (TTPs)
• Scripting and Automation (Python, PowerShell, Bash, or similar)
• Telecommunications and Enterprise Network Security
• Artificial Intelligence and AI-Assisted Security Analysis

• 7+ years of experience in Incident Response, Security Operations, Threat Hunting, Digital Forensics, or related cybersecurity disciplines.
• Experience leading large-scale or high-impact cybersecurity investigations.
• Experience developing detection logic, investigative methodologies, and response processes.
• Experience supporting cloud-native and hybrid enterprise environments.
• Strong understanding of threat actor behavior, attack frameworks, and incident lifecycle management.
• Industry certifications such as GCIH, GCFA, GCFE, GPEN, GCIA, CISSP, GNFA, or equivalent.

This is a senior incident response leadership role. Successful candidates should expect:

• Leading complex cybersecurity investigations from detection through remediation.
• Managing high-priority cybersecurity incidents with significant business impact.
• Conducting proactive threat hunting activities and intelligence-driven investigations.
• Producing executive-level communications and technical reporting.
• Mentoring analysts and investigators across the Incident Response organization.
• Collaborating with cross-functional cybersecurity and technology teams.
• Participating in an on-call rotation supporting critical cybersecurity events.
• Operating with a high degree of independence, accountability, and technical authority.

Job Contribution: An expert in their field, applying broad business knowledge and strategic insight surrounding emerging trends and technologies to solve complex problems and drive organizational results. Leads critical, high-impact projects and designs/implements innovative business strategies. Works with minimal oversight, frequently consulting senior leadership and influencing executive decisions. Serves as a mentor and assists others with challenging issues. Supervisor: No
TCP Career Step Differentiator: Manages and leads very complex cybersecurity work and is an expert in a specific cyber area. Creates plans that impact large organizations, multiple very complex applications/system, etc.
Education/Experience: Bachelor’s degree (BS/BA) desired in Computer Science or Cybersecurity. 7+ years of related experience. Certification is required in some areas.

Joining our team comes with amazing perks and benefits:

• Medical/Dental/Vision coverage
• 401(k) plan
• Tuition reimbursement program
• Paid Time Off and Holidays (based on date of hire, at least 23 days of vacation each year and 9 company-designated holidays)
• Paid Parental Leave
• Paid Caregiver Leave
• Additional sick leave beyond what state and local law require may be available but is unprotected
• Adoption Reimbursement
• Disability Benefits (short term and long term)
• Life and Accidental Death Insurance
• Supplemental benefit programs: critical illness/accident hospital indemnity/group legal
• Employee Assistance Programs (EAP)
• Extensive employee wellness programs
• Employee discounts up to 50% off on eligible AT&T mobility plans and accessories, AT&T internet (and fiber where available) and AT&T phone

Weekly Hours:

Time Type:

Location:

Salary Range:

AT&T and its subsidiaries are committed to equal employment opportunity. All hiring, promotion, and other employment decisions remain merit-based and free from discrimination on the basis of race, color, religion, religious creed, national origin, ancestry, age, sex, sexual orientation, gender, gender identity, gender expression, physical disability, mental disability, pregnancy, medical condition, genetic information, marital status, citizenship status, military status, veteran status, or any other characteristic protected by federal, state, or local laws. In addition, AT&T will provide reasonable accommodations to qualified individuals with disabilities. AT&T is a fair chance employer and does not initiate a background check until an offer is made. Click here to learn more or request an application accommodation here.