Principal Cybersecurity - Incident Response Analyst

Position Summary

The Principal Cybersecurity Incident Response Analyst is responsible for leading complex cybersecurity investigations and incident response activities across AT&T's enterprise environment. This role serves as the Lead Investigator for escalated security incidents, partnering closely with Security Operations, Digital Forensics, Threat Intelligence, Malware Analysis, Engineering, and business stakeholders to identify, contain, eradicate, and recover from cybersecurity threats.

The Principal Analyst provides expert-level technical leadership during significant cybersecurity incidents, conducts proactive threat hunting activities, and drives continuous improvement of incident response processes, detection capabilities, and investigative methodologies. This position requires strong investigative skills, deep technical expertise, executive-level communication abilities, and the ability to mentor others across the Incident Response organization.

This role participates in an on-call rotation and supports investigations involving endpoint systems, cloud environments, identity platforms, network infrastructure, telecommunications systems, applications, and emerging technologies.

• Lead cybersecurity investigations associated with escalated security incidents and suspicious activity.
• Serve as Lead Investigator (Handler) for all assigned escalated cybersecurity incidents.
• Coordinate and oversee all investigative, containment, eradication, and recovery activities associated with major cybersecurity events.
• Conduct major and micro-hunt investigations to identify malicious activity, assess risk, and improve organizational detection capabilities.
• Investigate threats, exploits, vulnerabilities, malware families, and advanced adversary activity across enterprise environments.
• Perform advanced host, network, log, cloud, and threat intelligence analysis.
• Produce technical reports, after-action reviews, executive summaries, and leadership briefings documenting investigative findings and recommendations.
• Collaborate with Security Operations, Threat Intelligence, Digital Forensics, Malware Analysis, Engineering, Legal, Privacy, and other stakeholders during active investigations.
• Support the development and continuous improvement of incident response playbooks, processes, automation, and investigative methodologies.
• Design and facilitate tabletop exercises and cybersecurity incident simulations.
• Identify security control gaps and provide recommendations to improve organizational resilience.
• Mentor analysts and investigators throughout the Incident Response organization in both technical and professional development areas.
• Provide executive-level communications during significant cybersecurity events.

Experience or working knowledge in several of the following areas:

• Cyber Incident Response
• Threat Hunting
• Digital Forensics
• Threat Intelligence Analysis
• Security Operations
• SIEM Technologies (Splunk or equivalent)
• Endpoint Detection and Response (EDR/XDR)
• Cloud Security (AWS, Azure, and SaaS platforms)
• Host and Network Forensics
• Malware Analysis Fundamentals
• Vulnerability Assessment and Exploitation Techniques
• Intrusion Detection and Anomaly Detection
• Security Alert Design and Detection Engineering
• Network Protocol Analysis
• Windows, Linux, and macOS Investigations
• Threat Actor Tactics, Techniques, and Procedures (TTPs)
• Scripting and Automation (Python, Power Shell, Bash, or similar)
• Telecommunications and Enterprise Network Security
• Artificial Intelligence and AI-Assisted Security Analysis

• 7+ years of experience in Incident Response, Security Operations, Threat Hunting, Digital Forensics, or related cybersecurity disciplines.
• Experience leading large-scale or high-impact cybersecurity investigations.
• Experience developing detection logic, investigative methodologies, and response processes.
• Experience supporting cloud-native and hybrid enterprise environments.
• Strong understanding of threat actor behavior, attack frameworks, and incident lifecycle management.
• Industry certifications such as GCIH, GCFA, GCFE, GPEN, GCIA, CISSP, GNFA, or equivalent.

This is a senior incident response leadership role. Successful candidates should expect:

• Leading complex cybersecurity investigations from detection through remediation.
• Managing high-priority cybersecurity incidents with significant business impact.
• Conducting proactive threat hunting activities and intelligence-driven…