Austin, Texas

AT&T is currently seeking candidates for a Cybersecurity Threat Hunter - Tier III SOC Analyst to be a part of a top-notch team of cybersecurity professionals. The role will involve working with our mid-large global business customers protecting their enterprises by leveraging AT&T Cybersecurity’s cutting-edge unified security technology and platforms. We are seeking an individual that can bring security analysis and incident response experience to support daily operations and to help scale this growing area of our business. 

As a Cybersecurity Threat Hunter, you will be responsible for participating in threat actor-based investigations, creating new detection methodologies, and provided expert support to incident response and monitoring functions. The focus of the Threat Hunter is to detect, disrupt and eradicate threat actors from impacting enterprise networks. To execute this mission, the Threat Hunter will use data analysis, threat intelligence, and cutting-edge security technologies. 
This role will also directly support the Security Operations Center by applying analytic and technical skills to investigate intrusions, identify malicious activity and potential insider threats, and perform incident response. 


• General SIEM monitoring, analysis, content development, and maintenance 
• Research, analysis, and response for alerts; including log retrieval and documentation 
• Conduct analysis of network traffic and host activity across a wide array of technologies and platforms 
• Assist in incident response activities such as host triage and retrieval, malware analysis, remote system analysis, end-user interviews, and remediation efforts 
• Compile detailed investigation and analysis reports for internal SOC consumption and delivery to management 
• Track threat actors and associated tactics, techniques, and procedures (TTPs) 
• Capture intelligence on threat actor TTPs and develop countermeasures in response to threat actors 
• Analyze network traffic, IDS/IPS/DLP events, packet capture, and FW logs 
• Analyze malicious campaigns and evaluate effectiveness of security technologies 
• Develop advanced queries and alerts to detect adversary actions 
• Coordinate threat hunting activities across the network leveraging intelligence from multiple internal and external sources, as well as cutting- edge security technologies 
• Assist in the design, evaluation, and implementation of new security technologies 
• Lead response and investigation efforts into advanced/targeted attacks 
• Hunt for and identify threat actor groups and their techniques, tools and processes 
• Identify gaps in IT infrastructure by mimicking an attacker’s behaviors and responses 
• Provide expert analytic investigative support of large scale and complex security incidents 
• Perform Root Cause Analysis of security incidents for further enhancement of alert catalog 
• Review alerts generated by detection infrastructure for false positive alerts and modify alerts as needed 
• Develop dashboards and reports to identify potential threats, suspicious/anomalous activity, malware, etc. 
• Provide forensic analysis of network packet captures, DNS, proxy, Netflow, malware, host-based security and application logs, as well as logs from various types of security sensors 
• A passion for research, and uncovering the unknown about internet threats and threat actors 
• Ensure the SOC analyst team is providing excellent customer service and support 


The Perks:
•Be part of a dynamic growing company that offers a meaningful and fun work environment.
•Comprehensive Total Rewards Package (Salary + Bonus incentives).
•Comprehensive PPO/HMO Medical/Dental/Vision.
•Paid: PTO, Sick Leave, Maternity/Paternity Leave, Service Day.
•Adoption & Surrogacy programs.
•401k + 100% matching up to 6%.
•Educational opportunities & Tuition Reimbursement.
•AT&T service discounts.
•AT&T service referral programs.
•Numerous industry awards and is recognized as a visionary in the industry.
•Strong year-over-year growth and a rapidly-growing customer base.


At AT&T Cybersecurity we celebrate and support the differences that make you, you. We’re proud to be an equal opportunity workplace and employer. We truly believe that diversity makes us better!


Required Qualifications: 
• 9+ years of relevant cyber security experience in IT Security, Incident Response or network security with strong knowledge working in a SOC 
• 3+ years experience with the incident response process, including detecting advanced adversaries, log analysis using Splunk or similar tools, and malware triage 
• Experience with creating automated log correlations in Splunk or a similar tool to identify anomalous and potentially malicious behavior 
• Demonstrated knowledge of the Splunk search language, search techniques, alerts, dashboards and report building. 
• Strong analytical and investigation skills 
• Experience with active threat hunting and adversary tracking 
• Working knowledge of security architectures and devices 
• Working knowledge of threat intelligence consumption and management 
• Working knowledge of root causes of malware infections and proactive mitigation 
• Working knowledge of lateral movement, footholds, and data exfiltration techniques 
• Experience with Netflow or PCAP analysis 
• Track record of creative problem solving, and the desire to create and build new processes 
• Experience and knowledge of packet flow, TCP/UDP traffic, firewall technologies, IDS technologies, proxy technologies, and antivirus, spam and spyware solutions 
• Convert intelligence into actionable mitigation and technical control recommendations 
• Experience with the Windows file system and registry functions or *NIX operating systems and command line tools 
• Knowledge of the underlying logic that security alerts are built upon and apply them when analyzing raw logs and creating new dashboards and alerts 
• Knowledge of typical behaviors of both malware and threat actors and how common protocols and applications work at the network level, including DNS, HTTP, and SMB. 
• Experience working in fast paced environments, and ability manage workload even during times of stress or escalated activity 
• Be familiar with using data visualization tools and penetration testing tools. Familiar with various Security Frameworks (NIST, ISO) and Compliance requirements. AWS and Azure Security 
• Comfortable with impromptu tasking and loosely defined requirements 
• Strong time management and multitasking skills as well as attention to detail 
• Strong collaborative skills and proven ability to work in a diverse team of security professionals 
• Excellent oral and written communications skills 

Preferred Qualifications: 
• Perform malware analysis 
• Experience with computer exploitation methodologies 
• Experience as a government contractor 
• Experience with one or more scripting languages (e.g., Python, JavaScript, Perl) 
• Perform memory analysis 

Education Requirement: 
• Bachelor’s degree or higher in a technical field such as Computer Science, Information Security, Information Technology, Computer Engineering, Information Systems, etc. Or 9+ years of relevant experience in lieu of a degree. 
Clearance Requirement: 
• Ability to obtain a Public Trust Clearance 

Austin, Texas

AT&T is bringing it all together for our customers, from revolutionary smartphones to next-generation TV services and sophisticated solutions for multi-national businesses.

For more than a century, we have consistently provided innovative, reliable, high-quality products and services and excellent customer care. Today, our mission is to connect people with their world, everywhere they live and work, and do it better than anyone else. We're fulfilling this vision by creating new solutions for consumers and businesses and by driving innovation in the communications and entertainment industry.

We're recognized as one of the leading worldwide providers of IP-based communications services to businesses. We also have the nation's most reliable 4G LTE network.* We also have the largest international coverage of any U.S. wireless carrier, offering the most phones that work in the most countries. AT&T operates the nation's largest Wi-Fi network** including more than 32,000 AT&T Wi-Fi Hot Spots at popular restaurants, hotels, bookstores and retailers, and provides access to nearly 1 million hotspots globally through roaming agreements.

AT&T U-verse is TV inspired by you. It's TV the way you want it, with tons of cool features and capabilities. AT&T is the only national TV service provider to offer a 100-percent IP-based television service. It's part of our "three-screen" integration strategy to deliver services across the three screens people rely on most - the mobile device, the PC and the TV.

As we continue to break new ground and deliver new solutions, we're focused on delivering the high-quality customer service that is our heritage.

Similar jobs