Senior Cybersecurity - Digital Forensic Investigator

The Senior Cybersecurity Digital Forensic Investigator is responsible for conducting digital forensic investigations in support of cybersecurity incidents across AT&T's enterprise environment. This role partners closely with Incident Response, Threat Intelligence, Malware Analysis, Engineering, and platform teams to determine what occurred, how it occurred, what systems were impacted, and what actions are required to reduce future risk.

The investigator is responsible for analyzing digital evidence, reconstructing timelines, determining scope and impact, identifying attack vectors, and producing technically accurate and defensible reports. This position requires independent investigative work, strong technical analysis skills, and the ability to communicate findings to both technical and non-technical audiences.

This role participates in an on-call rotation and supports investigations involving endpoint systems, cloud environments, identity platforms, network infrastructure, applications, and enterprise telecommunications systems. The position requires a strong foundation in digital forensics and a working understanding of modern threat actor tradecraft, incident response, cloud technologies, and artificial intelligence.

• →Conduct digital forensic investigations associated with cybersecurity incidents and suspicious activity.
• →Collect, preserve, process, and analyze digital evidence while maintaining evidentiary integrity and chain of custody.
• →Perform endpoint, memory, log, cloud, network, and live-response forensic analysis.
• →Determine attack scope, affected assets, root cause, and extent of compromise.
• →Reconstruct investigative timelines using forensic artifacts, telemetry, and log sources.
• →Produce detailed technical reports and executive-level summaries documenting investigative findings.
• →Collaborate with Incident Response, Threat Intelligence, Malware Analysis, platform teams, Legal, and other stakeholders during investigations.
• →Support investigations involving on-premises, cloud, and hybrid environments.
• →Utilize forensic findings to identify security control gaps and recommend improvements.
• →Assist with the development and improvement of forensic processes, methodologies, automation, and tooling.
• →Participate in an on-call rotation supporting time-sensitive investigations.
• →Remain current on emerging threats, attack techniques, forensic methodologies, and investigative technologies.
• →Evaluate and utilize emerging technologies, including artificial intelligence, to improve investigative efficiency and analytical effectiveness while understanding associated risks and limitations.
• →Minimum 3 years of experience in Digital Forensics, Incident Response, Cyber Threat Hunting, Security Operations, or a related cybersecurity discipline.

• →Experience conducting investigations involving Windows, Linux, macOS, cloud platforms, or enterprise network environments.
• →Experience analyzing forensic artifacts, logs, endpoint telemetry, and other investigative data sources.
• →Experience documenting findings and preparing technical reports.

Experience or working knowledge in several of the following areas:

• Digital Forensics
• Live Response
• Memory Forensics
• Endpoint Investigations
• Cloud Forensics
• Incident Response
• Threat Intelligence
• Malware Analysis Fundamentals
• Log Analysis
• Network Security and Protocols
• SIEM Platforms
• EDR Platforms
• Windows, Linux, and macOS
• Public Cloud Platforms (AWS and Azure)
• Scripting and Automation (Python, PowerShell, Bash, or similar)
• Identity and Access Management
• Web Applications and APIs
• Security Vulnerabilities and Attack Techniques
• Generative AI technologies, AI-assisted analysis techniques, and security considerations associated with AI systems. Applicants should be comfortable leveraging AI as a productivity and analytical tool while maintaining human validation of investigative conclusions.

• Industry certifications such as GCFA, GCFE, GCIH, GNFA, GCIA, CISSP, EnCE, CFCE, or equivalent.
• Experience supporting large-scale enterprise investigations.
• Experience with cloud-native security investigations.
• Experience supporting investigations involving telecommunications, network infrastructure, or large distributed environments.

This is an investigation-focused role. Successful candidates should expect:

• Writing detailed investigative reports.
• Leading investigations from evidence collection through final reporting.
• Working directly with engineers, security teams, and business stakeholders.
• Participating in an on-call rotation.
• Handling multiple investigations with competing priorities.
• Operating with a high degree of independence and accountability.
• Supporting investigations that may require rapid response and extended collaboration during significant cybersecurity events.

AT&T and its subsidiaries are committed to equal employment opportunity. All hiring, promotion, and other employment decisions remain merit-based and free from discrimination on the basis of race, color, religion, religious creed, national origin, ancestry, age, sex, sexual orientation, gender, gender identity, gender expression, physical disability, mental disability, pregnancy, medical condition, genetic information, marital status, citizenship status, military status, veteran status, or any other characteristic protected by federal, state, or local laws. In addition, AT&T will provide reasonable accommodations to qualified individuals with disabilities. AT&T is a fair chance employer and does not initiate a background check until an offer is made. Click here to learn more or request an application accommodation here.