Senior Cybersecurity - Digital Forensic Investigator

About the role

The Senior Cybersecurity Digital Forensic Investigator conducts digital forensic investigations supporting cybersecurity incidents across AT&T’s enterprise environment. The role partners with Incident Response, Threat Intelligence, Malware Analysis, Engineering, and platform teams to determine what occurred, how it occurred, which systems were impacted, and what actions are required to reduce future risk. Responsibilities include analyzing digital evidence, reconstructing timelines, determining scope and impact, identifying attack vectors, and producing technically accurate and defensible reports. The position involves independent investigative work, strong technical analysis skills, and communication of findings to both technical and non‑technical audiences. The investigator participates in an on‑call rotation and supports investigations involving endpoint systems, cloud environments, identity platforms, network infrastructure, applications, and enterprise telecommunications systems.

Responsibilities

• Conduct digital forensic investigations associated with cybersecurity incidents and suspicious activity.
• Collect, preserve, process, and analyze digital evidence while maintaining evidentiary integrity and chain of custody.
• Perform endpoint, memory, log, cloud, network, and live‑response forensic analysis.
• Determine attack scope, affected assets, root cause, and extent of compromise.
• Reconstruct investigative timelines using forensic artifacts, telemetry, and log sources.
• Produce detailed technical reports and executive‑level summaries documenting investigative findings.
• Collaborate with Incident Response, Threat Intelligence, Malware Analysis, platform teams, Legal, and other stakeholders during investigations.
• Support investigations involving on‑premises, cloud, and hybrid environments.
• Utilize forensic findings to identify security control gaps and recommend improvements.
• Assist with the development and improvement of forensic processes, methodologies, automation, and tooling.
• Participate in an on‑call rotation supporting time‑sensitive investigations.
• Remain current on emerging threats, attack techniques, forensic methodologies, and investigative technologies.
• Evaluate and utilize emerging technologies, including artificial intelligence, to improve investigative efficiency and analytical effectiveness while understanding associated risks and limitations.

Required Technical Knowledge

• Digital Forensics
• Live Response
• Memory Forensics
• Endpoint Investigations
• Cloud Forensics
• Incident Response
• Threat Intelligence
• Malware Analysis Fundamentals
• Log Analysis
• Network Security and Protocols
• SIEM Platforms
• EDR Platforms
• Windows, Linux, and macOS
• Public Cloud Platforms (AWS and Azure)
• Scripting and Automation (Python, PowerShell, Bash, or similar)
• Identity and Access Management
• Web Applications and APIs
• Security Vulnerabilities and Attack Techniques
• Generative AI technologies, AI‑assisted analysis techniques, and security considerations associated with AI systems

Preferred Qualifications

• Industry certifications such as GCFA, GCFE, GCIH, GNFA, GCIA, CISSP, EnCE, CFCE, or equivalent.
• Experience supporting large‑scale enterprise investigations.
• Experience with cloud‑native security investigations.
• Experience supporting investigations involving telecommunications, network infrastructure, or large distributed environments.

What Candidates Should Expect

• Writing detailed investigative reports.
• Leading investigations from evidence collection through final reporting.
• Working directly with engineers, security teams, and business stakeholders.
• Participating in an on‑call rotation.
• Handling multiple investigations with competing priorities.
• Operating with a high degree of independence and accountability.
• Supporting investigations that may require rapid response and extended collaboration during significant cybersecurity events.

Job Contribution

An experienced professional with advanced, interdisciplinary knowledge, resolving difficult and complex issues using broad professional concepts. Guides others, applying advanced principles and company practices. Leads moderate‑sized projects (or parts of larger projects) with strategic value. Operates autonomously with frequent senior leadership interaction.

Education & Experience

Bachelor’s degree (BS/BA) desired in Computer Science or Cybersecurity. 3+ years of related experience. Certification is required in some areas.

Pay

Annual salary range: $128,400 – $192,600 USD. Individual starting salary may depend on geography, experience, expertise, and education/training.

Benefits

• Medical/Dental/Vision coverage
• 401(k) plan
• Tuition reimbursement program
• Paid Time Off and Holidays (at least 23 days of vacation each year and 9 company‑designated holidays)
• Paid Parental Leave
• Paid Caregiver Leave
• Additional sick leave beyond statutory requirements (unprotected)
• Adoption Reimbursement
• Disability Benefits (short term and long term)
• Life and Accidental Death Insurance
• Supplemental benefit programs: critical illness/accident, hospital indemnity, group legal
• Employee Assistance Programs (EAP)
• Extensive employee wellness programs
• Employee discounts up to 50% off on eligible AT&T mobility plans and accessories, AT&T internet (and fiber where available) and AT&T phone

Schedule

Full‑time, 40 hours per week, regular schedule. Location: Charlotte, NC (8505 IBM Dr).