Principal Cybersecurity - Threat Hunter (Government)

AT&T Technical Services Company, Inc.; Chantilly (VA); On-site; USD 131,000 - 205,000; Full time

Benefits offered by this job

Medical coverage

Dental coverage

Vision coverage

401(k) plan

Tuition reimbursement

Paid time off

Parental leave

Caregiver leave

Adoption reimbursement

Disability benefits

Life Insurance

Employee discounts

Wellness programs

Job summary

AT&T Global Public Sector seeks a Principal Cybersecurity - Threat Hunter in Chantilly, VA. This role leads threat investigations, analyzes NetFlow and DNS metadata, and develops hunting playbooks. Expect collaboration with data scientists, engineers, and security engineers to advance capabilities.

The position is onsite five days a week. Required TS/SCI with polygraph, U.S. citizenship, and 3–5 years of threat hunting experience.

Qualifications

• Proactive, hypothesis-driven threat investigations over large datasets.
• Strong understanding of network protocols and metadata sources.
• Experience explaining technical findings to leadership and customers.

Responsibilities

• Lead threat analysis and investigations using NetFlow, DNS, and related telemetry.
• Identify anomalous behavior and potential indicators of compromise.
• Deliver recurring threat briefings and actionable recommendations to stakeholders.
• Develop repeatable threat-hunting tradecraft and reporting practices.
• Prototype queries and scripts to improve threat detection and analysis.
• Collaborate with cross-functional teams to advance threat-hunting methods.

Skills

Threat hunting

Network metadata analysis

Splunk/SIEM

TCP/IP knowledge

Communication skills

Customer-facing

Education

Bachelor’s degree or equivalent in cybersecurity/CS/IT

Tools

Splunk

SIEM

Job description

AT&T Global Public Sector is a trusted provider of secure, IP-enabled, cloud-based network solutions and professional services to the Federal Government. We are dedicated to recruiting, developing, and empowering a diverse, high-performing workforce that is passionate about what they do, committed to our shared values, and dedicated to our customers' missions.

AT&T Public Sector's National Security organization delivers mission-critical solutions supporting the nation's most important priorities. We serve customers across the Department of Defense, Department of Homeland Security, Defense Industrial Base, and Intelligence Community, combining AT&T's technology, global network capabilities, and experienced professionals to support highly sensitive and complex missions.

AT&T is seeking an experienced and intellectually curious Principal Cybersecurity - Threat Hunter to support a Federal National Security customer. This is not a traditional alert-monitoring or ticket-processing position. The successful candidate will proactively investigate large-scale network metadata, including NetFlow and DNS, develop and test hypotheses, identify meaningful patterns in ambiguous data, and translate technical evidence into clear, actionable intelligence. The successful candidate will synthesize analytic reports, assess their significance and limitations, and connect the findings into an understanding of threats and customer risk. The threat hunter will independently lead day-to-day mission support while working alongside a cross-functional cybersecurity team including data scientists, analysts, software developers, and security engineers. The role requires someone who enjoys finding the story within complex data, challenging initial assumptions, and pursuing investigative leads that may not be identified through predefined rules or traditional security alerts. This position will leverage AT&T's global network visibility, threat intelligence, analytics, and cybersecurity expertise to identify and investigate emerging threats. Approximately 50% of the role will focus on threat hunting, investigations, reporting, and customer briefings. The remaining time will support advancing threat-hunting tradecraft, evaluating new sources of threat intelligence, analytic prototyping, research and development, and peer collaboration. This is a full-time onsite role based in the location(s) posted and is performed from the designated work location five days per week. No relocation is offered. The position is primarily based at AT&T's Chantilly, Virginia office, with occasional presence expected at the customer site. The role generally operates during standard business hours.

Job Duties / Responsibilities

• Lead threat analysis and investigations using AT&T Internet traffic metadata, including NetFlow, DNS, and related network telemetry.
• Identify anomalous behavior, high-risk communications, malicious infrastructure, and potential indicators of compromise.
• Independently manage the day-to-day customer mission, including occasional presence on the customer operations floor.
• Prepare and deliver recurring threat briefings, investigative findings, and actionable recommendations to customer SOC and operations leadership.
• Develop and document repeatable threat-hunting tradecraft, playbooks, analytic workflows, and reporting practices.
• Prototype Splunk/SIEM queries and dashboards, lightweight scripts, visualizations, and new hunt concepts to improve threat detection and analysis.
• Translate threat-hunting tradecraft into functional and analytic requirements for developers, engineers, and data scientists.
• Collaborate with AT&T analysts, intelligence teams, developers, and data scientists to advance threat-hunting methods and customer capabilities.
• Mentor other analysts and contribute to peer reviews, knowledge sharing, and continuous improvement.

Clearance Requirements

• Required Clearance: TS/SCI with polygraph. (#ts/sci) (#polygraph)
• Additional Clearance Requirements: U.S. citizenship; customer-required polygraph; clearance, polygraph, and customer access eligibility must be maintained.

Required Qualifications

• Bachelor’s degree or equivalent work experience in cybersecurity, computer science, information technology, data science, intelligence studies, mathematics, or similar discipline
• Minimum of 3 to 5 years of experience in threat hunting, network security analysis, cyber threat intelligence, incident investigation, or a related analytical discipline.
• Demonstrated ability to conduct proactive, hypothesis-driven investigations across large datasets, particularly when information is incomplete or does not match a predefined alert.
• Strong knowledge of TCP/IP, Internet infrastructure, and network behavior, with hands‑on experience analyzing NetFlow, DNS, or comparable network metadata.
• Experience using Splunk or another analytics or SIEM platform to query, correlate, investigate, and visualize security data.
• Knowledge of attacker behavior, threat intelligence, indicators of compromise, and adversary tactics, techniques, and procedures.
• Ability to identify meaningful patterns and anomalies, evaluate competing explanations, and distinguish observed facts from analytic judgments.
• Strong written and verbal communication skills, including experience presenting technical findings, confidence assessments, and actionable recommendations to customer security and operations leaders.
• Ability to independently manage a customer-facing engagement while collaborating effectively with analysts, intelligence teams, engineers, developers, and data scientists.
• Ability to prototype queries, lightweight scripts, or analytic workflows and translate investigative needs into clear technical requirements.
• Working knowledge of Linux and command-line analysis tools.

Desired Qualifications

• Experience using threat intelligence platforms and sources such as MISP, OSINT, government, or commercial intelligence.
• Experience tracking threat actors, malicious infrastructure, botnets, command-and-control activity, proxies, scanning, beaconing, or exploitation behavior.
• Experience developing threat-hunting playbooks, mapping findings to MITRE ATT&CK, and converting investigations into repeatable methods.
• Familiarity with Python, SQL, shell scripting, statistical baselining, anomaly analysis, data visualization, or evaluating AI/ML-assisted analytics.
• Academic or professional exposure to economics, philosophy, intelligence analysis, or another discipline emphasizing critical reasoning, hypothesis development, pattern recognition, and evidence-based argumentation.
• Experience supporting Federal or National Security customers, working in classified environments, or operating alongside customer SOC and operations teams.
• Relevant cybersecurity certifications such as CISSP, Security+, CySA+, GIAC, Splunk, or comparable credentials.

Benefits

• Medical/Dental/Vision coverage
• 401(k) plan
• Tuition reimbursement program
• Paid Time Off and Holidays (based on date of hire, at least 23 days of vacation each year and 9 company-designated holidays) *Pro-rated when working less than 40 hrs/wk.
• Paid Parental Leave
• Paid Caregiver Leave
• Additional sick leave beyond what state and local law require may be available but is unprotected
• Adoption Reimbursement
• Disability Benefits (short term and long term)
• Life and Accidental Death Insurance
• Supplemental benefit programs: critical illness/accident hospital indemnity/group legal Employee Assistance Programs (EAP) Extensive employee wellness programs
• Employee discounts up to 50% off on eligible AT&T mobility plans and accessories, AT&T internet (and fiber where available) and AT&T wireline phone

Job Details

• Weekly Hours: 40
• Time Type: Regular
• Location: Chantilly, Virginia

Our Principal Cybersecurity - Threat Hunter (Government) earns $130,700 - $205,000 yearly.

AT&T and its subsidiaries are committed to equal employment opportunity. All hiring, promotion, and other employment decisions remain merit-based and free from discrimination on the basis of race, color, religion, religious creed, national origin, ancestry, age, sex, sexual orientation, gender, gender identity, gender expression, physical disability, mental disability, pregnancy, medical condition, genetic information, marital status, citizenship status, military status, veteran status, or any other characteristic protected by federal, state, or local laws. In addition, AT&T will provide reasonable accommodations to qualified individuals with disabilities.

AT&T is a fair chance employer and does not initiate a background check until an offer is made.

We are pioneers of making connections and have been ever since Alexander Graham Bell invented the telephone and founded our company. That was nearly 150 years ago, and we haven’t stopped innovating since. At our core, we help bring families, communities, and businesses together with the products and services they need to thrive every day. From the widespread and growing availability of 5G and Fiber to working on things we once only dreamed of—at AT&T, we create connections that change the world.