Adversary Threat Hunter

Position Overview: 

Southern Company is seeking a knowledgeable, hands-on Adversary Threat Hunter to join our Cyber Security team. This role leads proactive threat hunting engagements to identify suspicious behavior, adversary activity, and unauthorized access across Southern Company networks and systems. The position also supports incident response, detection engineering, investigative processes, and recommendations for security technologies and controls that improve the company’s defensive posture.

The ideal candidate will have a strong cybersecurity and security operations background, with forensic, investigative, analytical, threat intelligence, and technical skills.

Qualifications: 

• Bachelor’s degree or equivalent experience
• 7 or more years of information technology security experience
• Broad knowledge of information security principles, including access control, least privilege, data integrity, and core security capabilities
• Strong understanding of network design principles, including topology, protocols, network components, and virtualized infrastructure
• Practical experience with Splunk, Gravwell, or other Security Information and Event Management (SIEM) platforms
• Demonstrated experience in security operations, including security monitoring, incident response, host or network forensics, penetration testing, cyber threat intelligence, malware analysis, or security consulting
• Experience performing forensic analysis on Windows and Linux/Unix systems
• Experience using Endpoint Detection and Response (EDR), Network Detection and Response (NDR), Security Orchestration, Automation, and Response (SOAR), and related cybersecurity tools to support threat hunting, investigation, and response
• Experience with memory analysis, disk artifact collection, endpoint telemetry, and forensic acquisition methods used to identify malicious or evasive activity
• Ability to develop threat hunting hypotheses from cyber threat intelligence, incident response findings, adversary tradecraft, vulnerability information, and business risk priorities
• Ability to evaluate available data sources, identify visibility gaps, and determine whether logs, telemetry, or security tooling are sufficient to validate a hunt hypothesis
• Basic understanding of YARA, Snort, Sigma, or similar detection logic
• Experience using data analysis methods such as searching, filtering, grouping, stacking, baselining, anomaly detection, visualization, and trend analysis to identify suspicious behavior
• Experience mapping adversary behaviors to MITRE ATT&CK, MITRE ATT&CK for ICS, Cyber Kill Chain, Diamond Model, or similar analytical frameworks to prioritize hunt activity and detection improvements
• Familiarity with the threat intelligence lifecycle and adversary tactics, techniques, and procedures, including cybercrime, malware, botnets, hacktivism, social engineering, advanced persistent threats, and insider threats
• Familiarity with Operational Technology (OT) networks and processes
• Understanding of how threat hunting differs between Information Technology (IT) and Operational Technology (OT) environments, including safety considerations, specialized protocols, logging limitations, and coordination with operational teams
• Experience drafting security operations processes and procedures
• Ability to organize tasks, manage multiple priorities, meet schedules, and deliver on commitments
• Ability to document hunt plans, analytical methods, evidence, findings, limitations, recommendations, and lessons learned in a repeatable format
• Strong written and verbal communication skills

Job Responsibilities:    

• Plan and conduct structured, hypothesis-driven threat hunting engagements

• Collect and analyze data from multiple sources and tools to identify anomalies, suspicious activity, and potential adversary behavior

• Maintain awareness of the current threat landscape through intelligence reports, internet research, and sector-specific sources

• Partner with the Cyber Threat Intelligence team to understand threat actor behavior, tactics, techniques, procedures, and emerging threats

• Support detection engineering and security monitoring by recommending improved SIEM detections, alert logic, and related capabilities

• Recommend and support implementation of security controls and solutions based on lessons learned from hunting engagements

• Partner with Threat Analysis and Incident Response teams to evaluate adversary techniques and improve defensive capabilities

• Support incident response, remediation, recovery, threat scenario development, and response playbooks

Job Requirements:   

• Must pass NERC CIP and Insider Threat Protection background checks

• Ability to work independently and as part of a team

• Ability to understand business requirements, communicate technical findings, and recommend appropriate solutions

• Strong critical thinking, independent judgment, and creative problem-solving skills

• Occasional travel to local and regional locations in support of job duties and requirements

Desired certifications (one or more of the following): 

• Offensive Security Certified Professional (OSCP)

• GIAC Security Essentials (GSEC)

• GIAC Certified Forensic Examiner (GCFE)

• GIAC Certified Incident Handler (GCIH)

• GIAC Certified Intrusion Analyst (GCIA)