Principal Cybersecurity - Threat Hunter (Government)

AT&T•Chantilly, VA

7d•$130,700 - $205,000•Onsite

About The Position

AT&T Global Public Sector is seeking an experienced and intellectually curious Principal Cybersecurity - Threat Hunter to support a Federal National Security customer. The role focuses on proactively investigating large-scale network metadata, including NetFlow and DNS, developing and testing hypotheses, identifying meaningful patterns in ambiguous data, and translating technical evidence into clear, actionable intelligence. The threat hunter will synthesize analytic reports, assess their significance and limitations, and connect findings to threats and customer risk. The successful candidate will independently lead day-to-day mission support as part of a cross-functional cybersecurity team that includes data scientists, analysts, software developers, and security engineers. This is not a traditional alert-monitoring or ticket-processing position; it calls for someone who can find insights in complex data, challenge assumptions, and pursue leads beyond predefined rules and conventional alerts. Approximately half the role is devoted to threat hunting, investigations, reporting, and customer briefings. The remaining time supports advancing threat-hunting tradecraft, evaluating threat-intelligence sources, analytic prototyping, research and development, and peer collaboration. The position is full-time and onsite at AT&T's Chantilly, Virginia office five days per week, with occasional presence at the customer site. It generally operates during standard business hours. No relocation is offered. The role requires an active and maintainable TS/SCI clearance with polygraph, U.S. citizenship, customer-required polygraph, and continued customer access eligibility.

Requirements

Bachelor’s degree or equivalent work experience in cybersecurity, computer science, information technology, data science, intelligence studies, mathematics, or a similar discipline.
3 to 5 years of experience in threat hunting, network security analysis, cyber threat intelligence, incident investigation, or a related analytical discipline.
Demonstrated ability to conduct proactive, hypothesis-driven investigations across large datasets, particularly when information is incomplete or does not match a predefined alert.
Strong knowledge of TCP/IP, Internet infrastructure, and network behavior, with hands-on experience analyzing NetFlow, DNS, or comparable network metadata.
Experience using Splunk or another analytics or SIEM platform to query, correlate, investigate, and visualize security data.
Knowledge of attacker behavior, threat intelligence, indicators of compromise, and adversary tactics, techniques, and procedures.
Ability to identify meaningful patterns and anomalies, evaluate competing explanations, and distinguish observed facts from analytic judgments.
Strong written and verbal communication skills, including experience presenting technical findings, confidence assessments, and actionable recommendations to customer security and operations leaders.
Ability to independently manage a customer-facing engagement while collaborating effectively with analysts, intelligence teams, engineers, developers, and data scientists.
Ability to prototype queries, lightweight scripts, or analytic workflows and translate investigative needs into clear technical requirements.
Working knowledge of Linux and command-line analysis tools.
U.S. citizenship; customer-required polygraph; clearance, polygraph, and customer access eligibility must be maintained.
Required TS/SCI clearance with polygraph.

Nice To Haves

Experience using threat intelligence platforms and sources such as MISP, OSINT, government, or commercial intelligence.
Experience tracking threat actors, malicious infrastructure, botnets, command-and-control activity, proxies, scanning, beaconing, or exploitation behavior.
Experience developing threat-hunting playbooks, mapping findings to MITRE ATT&CK, and converting investigations into repeatable methods.
Familiarity with Python, SQL, shell scripting, statistical baselining, anomaly analysis, data visualization, or evaluating AI/ML-assisted analytics.
Academic or professional exposure to economics, philosophy, intelligence analysis, or another discipline emphasizing critical reasoning, hypothesis development, pattern recognition, and evidence-based argumentation.
Experience supporting Federal or National Security customers, working in classified environments, or operating alongside customer SOC and operations teams.
Relevant cybersecurity certifications such as CISSP, Security+, CySA+, GIAC, Splunk, or comparable credentials.

Responsibilities

Lead threat analysis and investigations using AT&T Internet traffic metadata, including NetFlow, DNS, and related network telemetry.
Identify anomalous behavior, high-risk communications, malicious infrastructure, and potential indicators of compromise.
Independently manage day-to-day customer mission support, including occasional presence on the customer operations floor.
Prepare and deliver recurring threat briefings, investigative findings, and actionable recommendations to customer SOC and operations leadership.
Develop and document repeatable threat-hunting tradecraft, playbooks, analytic workflows, and reporting practices.
Prototype Splunk/SIEM queries and dashboards, lightweight scripts, visualizations, and new hunt concepts to improve threat detection and analysis.
Translate threat-hunting tradecraft into functional and analytic requirements for developers, engineers, and data scientists.
Collaborate with AT&T analysts, intelligence teams, developers, and data scientists to advance threat-hunting methods and customer capabilities.
Mentor other analysts and contribute to peer reviews, knowledge sharing, and continuous improvement.

Benefits

Medical, dental, and vision coverage
401(k) plan
Tuition reimbursement program
Paid Time Off and holidays, including at least 23 vacation days per year and 9 company-designated holidays, based on date of hire
Paid parental leave
Paid caregiver leave
Additional sick leave may be available beyond what state and local law require
Adoption reimbursement
Short-term and long-term disability benefits
Life and accidental death insurance
Supplemental benefit programs, including critical illness, accident, hospital indemnity, and group legal
Employee Assistance Programs (EAP)
Employee wellness programs
Employee discounts of up to 50% on eligible AT&T mobility plans and accessories, AT&T internet and fiber where available, and AT&T wireline phone