Lead Cybersecurity - Insider Risk Analyst 2 Locations

<p><b>Job Description:</b></p><p><b>This position requires office presence of a minimum of 5 days per week and is only located in the location(s) posted. No relocation is offered.</b></p><p></p><p>Join AT&T and help shape the future of communications and technology that connect the world. We value innovators who seek to explore the unknown and challenge the status quo. Bring your bold ideas and fearless spirit to redefine connectivity and transform how people share stories and experiences. At AT&T, you won’t just imagine the future—you’ll build it.</p><p></p><p>The Lead Cybersecurity Insider Risk Analyst is responsible for leading the response to high-priority and escalated cybersecurity incidents, overseeing the detection, analysis, response, reporting, and prevention of threats across AT&T employees, contractors and third-party vendors.  This senior analyst proactively drives the creation and deployment of new detection rules, adapting to active threats and evolving suspicious behaviors. The role requires a high degree of organization, advanced technical acumen, and the ability to manage complex incidents, mentor team members, and communicate effectively with both executive leadership and business units. The ideal candidate will excel in incident response leadership, technical investigation, and continuous improvement of security operations.</p><p></p><p><b>General Responsibilities</b></p><p>The Lead Cybersecurity Insider Risk Analyst leads escalated incident management as the primary investigator and incident handler, ensuring all tasks are executed efficiently and thoroughly. This role plays a key part in developing incident response processes, driving remediation, contributing to threat intelligence, and providing executive-level communication. The analyst also supports tabletop exercises and serves as a mentor and subject matter expert across the cybersecurity team.</p><p></p><p><b>Core Responsibilities</b></p><ul><li><span>Manage all cases as Lead Handler for escalated cybersecurity incidents.</span></li><li><span>Oversee all tasks related to escalated cases as Lead Investigator.</span></li><li><span>Investigate all escalated security events, ensuring comprehensive analysis and response.</span></li><li><span>Assist with “Micro-hunts” to discover, analyze, and report on actionable threat intelligence.</span></li><li><span>Support the development and continuous improvement of incident response processes.</span></li><li><span>Drive remediation efforts for all cybersecurity incidents assigned to the team.</span></li><li><span>Perform skilled triage of threats using advanced technical and business knowledge.</span></li><li><span>Mentor team members in triage, leveraging business knowledge and incident response frameworks.</span></li><li><span>Assist with scenario development for tabletop exercises across the Incident Response team.</span></li><li><span>Document and communicate findings and after-action reports in formats required by leadership.</span></li><li><span>Function as a mentor and subject matter expert to other Incident Responders.</span></li><li><span>Serve as a scribe when requested, maintaining accurate records of incidents.</span></li><li><span>Provide executive-level communications to leadership and stakeholders.</span></li></ul><p></p><p><b>Technical Responsibilities</b></p><ul><li><span>Utilize case management tools, host/network analysis, and threat intelligence platforms for incident response.</span></li><li><span>Apply strong knowledge in incident handling processes, lifecycle, and attack frameworks.</span></li><li><span>Conduct in-depth analysis of threats, exploits, vulnerabilities, and malware families.</span></li><li><span>Perform investigations across Windows, OSX, and Lenox operating systems.</span></li><li><span>Leverage Endpoint Detection and Response (EDR) technologies and conduct cloud security analysis.</span></li><li><span>Use SPLUNK and other analytics tools for advanced investigations and reporting.</span></li><li><span>Understand company infrastructure, including VPNs, AVPNs, and business partner connectivity.</span></li><li><span>Demonstrate expert familiarity with networking, internet communication methods, and general computing protocols.</span></li><li><span>Design and implement new security detection methods in response to emerging threats.</span></li><li><span>Collaborate with other Threat Analytic teams, understanding their functions and interactions.</span></li><li><span>Mentor team members in skilled triage and advanced practices.</span></li><li><span>Generate reports and documentation related to incident response activities.</span></li><li><span>Maintain knowledge of SaaS services, mobility threats, and security in cloud environments.</span></li><li><span>Exhibit strong understanding of scripting languages (e.g., Python, PowerShell, Bash) for automation and analysis.</span></li><li><span>Assist with algorithm development and advanced threat intelligence analysis.</span></li></ul><p></p><p><b>Technical Skills</b></p><ul><li><span>Working knowledge of at least four of the following: incident management technologies, OS hardening, cloud environments, host analysis, network forensics, malware reversing, intrusion detection, anomaly detection, threat research, threat intelligence, security alert design, data analysis.</span></li><li><span>Strong knowledge of incident handling, lifecycle, and attack frameworks.</span></li><li><span>Advanced proficiency in incident response, triage, and remediation.</span></li><li><span>Expertise in host and network analysis, EDR technologies, and SPLUNK.</span></li><li><span>Good understanding of cloud security analysis, internet-based threats, and SaaS services.</span></li><li><span>Strong familiarity with company infrastructure (VPNs/AVPNs), mobility threats, and networking.</span></li><li><span>Expert familiarity with general computing protocols and malware/network attack vectors.</span></li><li><span>Experience designing and implementing security detection methods.</span></li><li><span>Understanding of scripting languages for automation and analysis.</span></li><li><span>Ability to mentor and train others at a senior level.</span></li></ul><p></p><p><b>Soft Skills & Traits</b></p><ul><li><span>Excellent analytical and problem-solving skills, with the ability to perform core root cause analysis.</span></li><li><span>Quick learner, able to absorb and teach new technologies and concepts.</span></li><li><span>Highly effective collaborator, especially in remote or distributed teams.</span></li><li><span>Excels in business communication methods and general soft skills.</span></li><li><span>Strong understanding of the business, its entities, and how cybersecurity impacts the broader organization.</span></li><li><span>Professional integrity and discretion in handling sensitive information.</span></li><li><span>Commitment to continuous learning and staying current with emerging cybersecurity threats and best practices.</span></li></ul><p><br /><b>Education/Experience:</b></p><p>Bachelor’s degree (BS/BA) desired in Computer Science or Cybersecurity. 5+ years of related experience. Certification is required in some areas.</p><p></p><p>Our Lead Cybersecurity earns between $128,400-$192,600 USD Annual, not to mention all the other amazing rewards that working at AT&T offers. Individual starting salary within this range may depend on geography, experience, expertise, and education/training.  </p><p></p><p><b>Joining our team comes with amazing perks and benefits:</b></p><ul><li>Medical/Dental/Vision coverage  </li><li>401(k) plan  </li><li>Tuition reimbursement program  </li><li>Paid Time Off and Holidays (based on date of hire, at least 23 days of vacation each year and 9 company-designated holidays)  </li><li>Paid Parental Leave  </li><li>Paid Caregiver Leave  </li><li>Additional sick leave beyond what state and local law require may be available but is unprotected  </li><li>Adoption Reimbursement  </li><li>Disability Benefits (short term and long term)  </li><li>Life and Accidental Death Insurance  </li><li>Supplemental benefit programs: critical illness/accident hospital indemnity/group legal  </li><li>Employee Assistance Programs (EAP)  </li><li>Extensive employee wellness programs  </li><li>Employee discounts up to 50% off on eligible AT&T mobility plans and accessories,</li><li>AT&T internet (and fiber where available) and AT&T phone.</li></ul><p></p><p>#LI-Onsite – Full-time office role-</p><div><p></p><p>Ready to join our team? Apply today.</p></div><p><br /><br /><br /> </p><p></p><p><b>Weekly Hours:</b></p>40<p></p><p><b>Time Type:</b></p>Regular<p></p><p><b>Location:</b></p>USA:NC:Charlotte / Research Dr - Dat:9139 Research Dr<p></p><p><b>Salary Range: </b></p>$128,400.00 - $215,800.00<p></p><p><span>It is the policy of AT&T to provide equal employment opportunity (EEO) to all persons regardless of age, color, national origin, citizenship status, physical or mental disability, race, religion, creed, gender, sex, sexual orientation, gender identity and/or expression, genetic information, marital status, status with regard to public assistance, veteran status, or any other characteristic protected by federal, state or local law. In addition, AT&T will provide reasonable accommodations for qualified individuals with disabilities. </span><span>AT&T is a fair chance employer and does not initiate a background check until an offer is made.</span></p>

Back to blog

Common Interview Questions And Answers

1. HOW DO YOU PLAN YOUR DAY?

This is what this question poses: When do you focus and start working seriously? What are the hours you work optimally? Are you a night owl? A morning bird? Remote teams can be made up of people working on different shifts and around the world, so you won't necessarily be stuck in the 9-5 schedule if it's not for you...

2. HOW DO YOU USE THE DIFFERENT COMMUNICATION TOOLS IN DIFFERENT SITUATIONS?

When you're working on a remote team, there's no way to chat in the hallway between meetings or catch up on the latest project during an office carpool. Therefore, virtual communication will be absolutely essential to get your work done...

3. WHAT IS "WORKING REMOTE" REALLY FOR YOU?

Many people want to work remotely because of the flexibility it allows. You can work anywhere and at any time of the day...

4. WHAT DO YOU NEED IN YOUR PHYSICAL WORKSPACE TO SUCCEED IN YOUR WORK?

With this question, companies are looking to see what equipment they may need to provide you with and to verify how aware you are of what remote working could mean for you physically and logistically...

5. HOW DO YOU PROCESS INFORMATION?

Several years ago, I was working in a team to plan a big event. My supervisor made us all work as a team before the big day. One of our activities has been to find out how each of us processes information...

6. HOW DO YOU MANAGE THE CALENDAR AND THE PROGRAM? WHICH APPLICATIONS / SYSTEM DO YOU USE?

Or you may receive even more specific questions, such as: What's on your calendar? Do you plan blocks of time to do certain types of work? Do you have an open calendar that everyone can see?...

7. HOW DO YOU ORGANIZE FILES, LINKS, AND TABS ON YOUR COMPUTER?

Just like your schedule, how you track files and other information is very important. After all, everything is digital!...

8. HOW TO PRIORITIZE WORK?

The day I watched Marie Forleo's film separating the important from the urgent, my life changed. Not all remote jobs start fast, but most of them are...

9. HOW DO YOU PREPARE FOR A MEETING AND PREPARE A MEETING? WHAT DO YOU SEE HAPPENING DURING THE MEETING?

Just as communication is essential when working remotely, so is organization. Because you won't have those opportunities in the elevator or a casual conversation in the lunchroom, you should take advantage of the little time you have in a video or phone conference...

10. HOW DO YOU USE TECHNOLOGY ON A DAILY BASIS, IN YOUR WORK AND FOR YOUR PLEASURE?

This is a great question because it shows your comfort level with technology, which is very important for a remote worker because you will be working with technology over time...