Adversary Threat Hunter

Adversary Threat HunterJob Description At Southern Company, our core objective is to provide a safe, reliable computing environment for the consumers of our services, both internally and externally. Our complex environment requires continual innovation and effective use of evolving technologies. Protecting the network helps ensure our users remain connected to critical applications, products, and services.Position Overview: Southern Company is seeking a knowledgeable, hands-on Adversary Threat Hunter to join our Cyber Security team. This role leads proactive threat hunting engagements to identify suspicious behavior, adversary activity, and unauthorized access across Southern Company networks and systems. The position also supports incident response, detection engineering, investigative processes, and recommendations for security technologies and controls that improve the company’s defensive posture.The ideal candidate will have a strong cybersecurity and security operations background, with forensic, investigative, analytical, threat intelligence, and technical skills.Qualifications: Bachelor’s degree or equivalent experience7 or more years of information technology security experienceBroad knowledge of information security principles, including access control, least privilege, data integrity, and core security capabilitiesStrong understanding of network design principles, including topology, protocols, network components, and virtualized infrastructurePractical experience with Splunk, Gravwell, or other Security Information and Event Management (SIEM) platformsDemonstrated experience in security operations, including security monitoring, incident response, host or network forensics, penetration testing, cyber threat intelligence, malware analysis, or security consultingExperience performing forensic analysis on Windows and Linux/Unix systemsExperience using Endpoint Detection and Response (EDR), Network Detection and Response (NDR), Security Orchestration, Automation, and Response (SOAR), and related cybersecurity tools to support threat hunting, investigation, and responseExperience with memory analysis, disk artifact collection, endpoint telemetry, and forensic acquisition methods used to identify malicious or evasive activityAbility to develop threat hunting hypotheses from cyber threat intelligence, incident response findings, adversary tradecraft, vulnerability information, and business risk prioritiesAbility to evaluate available data sources, identify visibility gaps, and determine whether logs, telemetry, or security tooling are sufficient to validate a hunt hypothesisBasic understanding of YARA, Snort, Sigma, or similar detection logicExperience using data analysis methods such as searching, filtering, grouping, stacking, baselining, anomaly detection, visualization, and trend analysis to identify suspicious behaviorExperience mapping adversary behaviors to MITRE ATT&CK, MITRE ATT&CK for ICS, Cyber Kill Chain, Diamond Model, or similar analytical frameworks to prioritize hunt activity and detection improvementsFamiliarity with the threat intelligence lifecycle and adversary tactics, techniques, and procedures, including cybercrime, malware, botnets, hacktivism, social engineering, advanced persistent threats, and insider threatsFamiliarity with Operational Technology (OT) networks and processesUnderstanding of how threat hunting differs between Information Technology (IT) and Operational Technology (OT) environments, including safety considerations, specialized protocols, logging limitations, and coordination with operational teamsExperience drafting security operations processes and proceduresAbility to organize tasks, manage multiple priorities, meet schedules, and deliver on commitmentsAbility to document hunt plans, analytical methods, evidence, findings, limitations, recommendations, and lessons learned in a repeatable formatStrong written and verbal communication skillsAbout Southern CompanySouthern Company (NYSE: SO) is a leading energy provider serving 9 million customers across the Southeast and beyond through its family of companies. Providing clean, safe, reliable and affordable energy with excellent service is our mission. The company has electric operating companies in three states, natural gas distribution companies in four states, a competitive generation company, a leading distributed energy solutions provider with national capabilities, a fiber optics network and telecommunications services. Through an industry-leading commitment to innovation, resilience and sustainability, we are taking action to meet customers' and communities' needs while advancing our goal of net-zero greenhouse gas emissions by 2050. Our uncompromising values ensure we put the needs of those we serve at the center of everything we do and are the key to our sustained success. We are transforming energy into economic, environmental and social progress for tomorrow. Our corporate culture has been recognized by a variety of organizations, earning the company awards and recognitions that reflect Our Values and dedication to service. To learn more, visit . Southern Company invests in the well-being of its employees and their families through a comprehensive total rewards strategy that includes competitive base salary, annual incentive awards for eligible employees and health, welfare and retirement benefits designed to support physical, financial, and emotional/social well-being. This position may also be eligible for additional compensation, such as an incentive program, with the amount of any bonus/awards subject to the terms and conditions of the applicable incentive plan(s). A summary of the benefits offered for this position can be found here . Additional and specific details about total compensation and benefits will also be provided during the hiring process. Southern Company is an equal opportunity employer where an applicant's qualifications are considered without regard to race, color, religion, sex, national origin, age, disability, veteran status, genetic information, sexual orientation, gender identity or expression, or any other basis prohibited by law. Southern Company ServicesJob Requirements: Must pass NERC CIP and Insider Threat Protection background checksAbility to work independently and as part of a teamAbility to understand business requirements, communicate technical findings, and recommend appropriate solutionsStrong critical thinking, independent judgment, and creative problem-solving skillsOccasional travel to local and regional locations in support of job duties and requirementsDesired certifications (one or more of the following): Offensive Security Certified Professional (OSCP)GIAC Security Essentials (GSEC)GIAC Certified Forensic Examiner (GCFE)GIAC Certified Incident Handler (GCIH)GIAC Certified Intrusion Analyst (GCIA)Job Responsibilities: Plan and conduct structured, hypothesis-driven threat hunting engagementsCollect and analyze data from multiple sources and tools to identify anomalies, suspicious activity, and potential adversary behaviorMaintain awareness of the current threat landscape through intelligence reports, internet research, and sector-specific sourcesPartner with the Cyber Threat Intelligence team to understand threat actor behavior, tactics, techniques, procedures, and emerging threatsSupport detection engineering and security monitoring by recommending improved SIEM detections, alert logic, and related capabilitiesRecommend and support implementation of security controls and solutions based on lessons learned from hunting engagementsPartner with Threat Analysis and Incident Response teams to evaluate adversary techniques and improve defensive capabilitiesSupport incident response, remediation, recovery, threat scenario development, and response playbooksFull timePosting Date: 2026-08-06