Senior Cybersecurity - Digital Forensic Investigator

Position Summary The Senior Cybersecurity Digital Forensic Investigator is responsible for conducting digital forensic investigations in support of cybersecurity incidents across AT&T's enterprise environment. This role partners closely with Incident Response, Threat Intelligence, Malware Analysis, Engineering, and platform teams to determine what occurred, how it occurred, what systems were impacted, and what actions are required to reduce future risk. The investigator is responsible for analyzing digital evidence, reconstructing timelines, determining scope and impact, identifying attack vectors, and producing technically accurate and defensible reports. This position requires independent investigative work, strong technical analysis skills, and the ability to communicate findings to both technical and non-technical audiences. This role participates in an on-call rotation and supports investigations involving endpoint systems, cloud environments, identity platforms, network infrastructure, applications, and enterprise telecommunications systems. The position requires a strong foundation in digital forensics and a working understanding of modern threat actor tradecraft, incident response, cloud technologies, and artificial intelligence. Key Responsibilities Conduct digital forensic investigations associated with cybersecurity incidents and suspicious activity. Collect, preserve, process, and analyze digital evidence while maintaining evidentiary integrity and chain of custody. Perform endpoint, memory, log, cloud, network, and live-response forensic analysis. Determine attack scope, affected assets, root cause, and extent of compromise. Reconstruct investigative timelines using forensic artifacts, telemetry, and log sources. Produce detailed technical reports and executive-level summaries documenting investigative findings. Collaborate with Incident Response, Threat Intelligence, Malware Analysis, platform teams, Legal, and other stakeholders during investigations. Support investigations involving on-premises, cloud, and hybrid environments. Utilize forensic findings to identify security control gaps and recommend improvements. Assist with the development and improvement of forensic processes, methodologies, automation, and tooling. Participate in an on-call rotation supporting time-sensitive investigations. Remain current on emerging threats, attack techniques, forensic methodologies, and investigative technologies. Evaluate and utilize emerging technologies, including artificial intelligence, to improve investigative efficiency and analytical effectiveness while understanding associated risks and limitations. Minimum 3 years of experience in Digital Forensics, Incident Response, Cyber Threat Hunting, Security Operations, or a related cybersecurity discipline. Experience conducting investigations involving Windows, Linux, macOS, cloud platforms, or enterprise network environments. Experience analyzing forensic artifacts, logs, endpoint telemetry, and other investigative data sources. Experience documenting findings and preparing technical reports. Required Technical Knowledge Experience or working knowledge in several of the following areas: Digital Forensics Live Response Memory Forensics Endpoint Investigations Cloud Forensics Incident Response Threat Intelligence Malware Analysis Fundamentals Log Analysis Network Security and Protocols SIEM Platforms EDR Platforms Windows, Linux, and macOS Public Cloud Platforms (AWS and Azure) Scripting and Automation (Python, PowerShell, Bash, or similar) Identity and Access Management Web Applications and APIs Security Vulnerabilities and Attack Techniques Generative AI technologies, AI-assisted analysis techniques, and security considerations associated with AI systems. Applicants should be comfortable leveraging AI as a productivity and analytical tool while maintaining human validation of investigative conclusions. Preferred Qualifications Industry certifications such as GCFA, GCFE, GCIH, GNFA, GCIA, CISSP, EnCE, CFCE, or equivalent. Experience supporting large-scale enterprise investigations. Experience with cloud-native security investigations. Experience supporting investigations involving telecommunications, network infrastructure, or large distributed environments. What Candidates Should Expect This is an investigation-focused role. Successful candidates should expect: Writing detailed investigative reports. Leading investigations from evidence collection through final reporting. Working directly with engineers, security teams, and business stakeholders. Participating in an on-call rotation. Handling multiple investigations with competing priorities. Operating with a high degree of independence and accountability. Supporting investigations that may require rapid response and extended collaboration during significant cybersecurity events. Job Contribution: An experienced professional with advanced, interdisciplinary knowledge, resolving difficult and complex issues using broad professional concepts. Guides others, applying advanced principles and company practices. Leads moderate sized projects (or parts of larger projects) with strategic value. Operates autonomously with frequent senior leadership interaction. Supervisor: No TCP Career Step Differentiator: Manages complex cybersecurity work. Education/Experience: Bachelor’s degree (BS/BA) desired in Computer Science or Cybersecurity. 3+ years of related experience. Certification is required in some areas. Our Senior Cybersecurity jobs earn between $128,400.00 - $192,600.00 USD Annual. Not to mention all the other amazing rewards that working at AT&T offers. Individual starting salary within this range may depend on geography, experience, expertise, and education/training. Joining our team comes with amazing perks and benefits: Medical/Dental/Vision coverage 401(k) plan Tuition reimbursement program Paid Tim