Principal Cybersecurity - Threat Hunter (Government)

AT&T•Chantilly, VA

6d•Onsite

About The Position

AT&T Global Public Sector is seeking an experienced and intellectually curious Principal Cybersecurity - Threat Hunter to support a Federal National Security customer. This is a proactive investigative role, not a traditional alert-monitoring or ticket-processing position. The threat hunter analyzes large-scale Internet traffic metadata, including NetFlow, DNS, and related network telemetry, to develop and test hypotheses, identify patterns in ambiguous data, and turn technical evidence into clear, actionable intelligence. The role includes assessing the significance and limitations of analytic reports and connecting findings to threats and customer risk. The successful candidate independently leads day-to-day mission support while collaborating with a cross-functional cybersecurity team that includes analysts, intelligence teams, data scientists, software developers, and security engineers. Approximately 50% of the work focuses on threat hunting, investigations, reporting, and customer briefings. The remainder supports threat-hunting tradecraft, threat-intelligence evaluation, analytic prototyping, research and development, and peer collaboration. This is a full-time, onsite position based primarily at AT&T's Chantilly, Virginia office, with occasional presence at the customer site. Work is performed at the designated location five days per week, generally during standard business hours. No relocation is offered. The role requires TS/SCI with polygraph, U.S. citizenship, and continued eligibility for the required clearance, polygraph, and customer access.

Requirements

Bachelor’s degree or equivalent work experience in cybersecurity, computer science, information technology, data science, intelligence studies, mathematics, or a similar discipline.
3 to 5 years of experience in threat hunting, network security analysis, cyber threat intelligence, incident investigation, or a related analytical discipline.
Ability to conduct proactive, hypothesis-driven investigations across large datasets, particularly when information is incomplete or does not match a predefined alert.
Strong knowledge of TCP/IP, Internet infrastructure, and network behavior, with hands-on experience analyzing NetFlow, DNS, or comparable network metadata.
Experience using Splunk or another analytics or SIEM platform to query, correlate, investigate, and visualize security data.
Knowledge of attacker behavior, threat intelligence, indicators of compromise, and adversary tactics, techniques, and procedures.
Ability to identify meaningful patterns and anomalies, evaluate competing explanations, and distinguish observed facts from analytic judgments.
Strong written and verbal communication skills, including experience presenting technical findings, confidence assessments, and actionable recommendations to customer security and operations leaders.
Ability to independently manage a customer-facing engagement and collaborate effectively with analysts, intelligence teams, engineers, developers, and data scientists.
Ability to prototype queries, lightweight scripts, or analytic workflows and translate investigative needs into clear technical requirements.
Working knowledge of Linux and command-line analysis tools.
TS/SCI clearance with polygraph; U.S. citizenship and continued eligibility for the required clearance, polygraph, and customer access.

Nice To Haves

Experience using threat intelligence platforms and sources such as MISP, OSINT, government, or commercial intelligence.
Experience tracking threat actors, malicious infrastructure, botnets, command-and-control activity, proxies, scanning, beaconing, or exploitation behavior.
Experience developing threat-hunting playbooks, mapping findings to MITRE ATT&CK, and converting investigations into repeatable methods.
Familiarity with Python, SQL, shell scripting, statistical baselining, anomaly analysis, data visualization, or evaluating AI/ML-assisted analytics.
Academic or professional exposure to economics, philosophy, intelligence analysis, or another discipline emphasizing critical reasoning, hypothesis development, pattern recognition, and evidence-based argumentation.
Experience supporting Federal or National Security customers, working in classified environments, or operating alongside customer SOC and operations teams.
Relevant cybersecurity certifications such as CISSP, Security+, CySA+, GIAC, Splunk, or comparable credentials.

Responsibilities

Lead threat analysis and investigations using AT&T Internet traffic metadata, including NetFlow, DNS, and related network telemetry.
Identify anomalous behavior, high-risk communications, malicious infrastructure, and potential indicators of compromise.
Independently manage day-to-day customer mission support, including occasional presence on the customer operations floor.
Prepare and deliver recurring threat briefings, investigative findings, and actionable recommendations to customer SOC and operations leadership.
Develop and document repeatable threat-hunting tradecraft, playbooks, analytic workflows, and reporting practices.
Prototype Splunk/SIEM queries and dashboards, lightweight scripts, visualizations, and new hunt concepts to improve threat detection and analysis.
Translate threat-hunting tradecraft into functional and analytic requirements for developers, engineers, and data scientists.
Collaborate with AT&T analysts, intelligence teams, developers, and data scientists to advance threat-hunting methods and customer capabilities.
Mentor other analysts and contribute to peer reviews, knowledge sharing, and continuous improvement.

Benefits

Medical, dental, and vision coverage
401(k) plan
Tuition reimbursement program
Paid Time Off and Holidays: at least 23 vacation days each year and 9 company-designated holidays, based on date of hire; prorated for employees working less than 40 hours per week
Paid parental leave
Paid caregiver leave
Additional sick leave may be available beyond what state and local law require; such leave is unprotected
Adoption reimbursement
Short- and long-term disability benefits
Life and accidental death insurance
Supplemental benefit programs, including critical illness, accident, hospital indemnity, and group legal
Employee Assistance Programs (EAP)
Employee wellness programs
Employee discounts up to 50% on eligible AT&T mobility plans and accessories, AT&T internet and fiber where available, and AT&T wireline phone