Principal Cybersecurity - Threat Hunter (Government)

AT&T Mobility Services; Chantilly (VA); On-site; USD 150,000 - 190,000; Full time

Job summary

AT&T Public Sector seeks a Principal Cybersecurity Threat Hunter in Chantilly, VA. You will lead proactive investigations, analyze NetFlow/DNS metadata, and translate findings into actionable intelligence for a cross-functional team.

You will mentor analysts, develop playbooks, and deliver customer briefings while maintaining TS/SCI with polygraph clearance. Onsite five days a week with occasional customer-site presence.

Qualifications

• Bachelor's degree or equivalent in cybersecurity, computer science, information technology, data science, intelligence studies, mathematics, or similar discipline.
• Minimum 3–5 years in threat hunting, network security analysis or related analytical discipline.
• Proactive, hypothesis-driven investigations across large datasets with incomplete information.
• Strong knowledge of TCP/IP, Internet infrastructure and network behavior.
• Experience using Splunk or another SIEM to query, correlate, investigate and visualize security data.
• Knowledge of attacker behavior and threat intelligence.

Responsibilities

• Lead threat analysis and investigations using network metadata (NetFlow, DNS) and related telemetry.
• Identify anomalous behavior, high-risk communications, malicious infrastructure, and indicators of compromise.
• Manage day-to-day customer mission with occasional customer-site presence.
• Prepare and deliver recurring threat briefings, findings, and actionable recommendations to customer leadership.
• Develop repeatable threat-hunting tradecraft, playbooks, workflows, and reporting practices.
• Prototype queries, dashboards, scripts, and visualizations to improve threat detection.
• Translate hunt tradecraft into analytic requirements for engineers and data scientists.
• Collaborate with analysts, intelligence teams, developers, and data scientists to advance methods.
• Mentor analysts and contribute to peer reviews and knowledge sharing.

Skills

Threat hunting

Incident investigation

NetFlow/DNS analysis

Splunk/SIEM

TCP/IP knowledge

Data analysis

Education

Bachelor's degree or equivalent in cybersecurity / CS / IT

Tools

Splunk

Job description

AT&T Global Public Sector is a trusted provider of secure, IP-enabled, cloud-based network solutions and professional services to the Federal Government. We are dedicated to recruiting, developing, and empowering a diverse, high-performing workforce that is passionate about what they do, committed to our shared values, and dedicated to our customers' missions.

AT&T Public Sector's National Security organization delivers mission-critical solutions supporting the nation's most important priorities. We serve customers across the Department of Defense, Department of Homeland Security, Defense Industrial Base, and Intelligence Community, combining AT&T's technology, global network capabilities, and experienced professionals to support highly sensitive and complex missions.

AT&T is seeking an experienced and intellectually curious Principal Cybersecurity - Threat Hunter to support a Federal National Security customer. This is not a traditional alert-monitoring or ticket-processing position. The successful candidate will proactively investigate large-scale network metadata, including NetFlow and DNS, develop and test hypotheses, identify meaningful patterns in ambiguous data, and translate technical evidence into clear, actionable intelligence. The successful candidate will synthesize analytic reports, assess their significance and limitations, and connect the findings into an understanding of threats and customer risk.

The threat hunter will independently lead day-to-day mission support while working alongside a cross-functional cybersecurity team including data scientists, analysts, software developers, and security engineers. The role requires someone who enjoys finding the story within complex data, challenging initial assumptions, and pursuing investigative leads that may not be identified through predefined rules or traditional security alerts.

This position will leverage AT&T's global network visibility, threat intelligence, analytics, and cybersecurity expertise to identify and investigate emerging threats. Approximately 50% of the role will focus on threat hunting, investigations, reporting, and customer briefings. The remaining time will support advancing threat-hunting tradecraft, evaluating new sources of threat intelligence, analytic prototyping, research and development, and peer collaboration.

This is a full-time onsite role based in the location(s) posted and is performed from the designated work location five days per week. No relocation is offered.

The position is primarily based at AT&T's Chantilly, Virginia office, with occasional presence expected at the customer site. The role generally operates during standard business hours.

Description of Job Duties/Responsibilities:

• Lead threat analysis and investigations using AT&T Internet traffic metadata, including NetFlow, DNS, and related network telemetry.
• Identify anomalous behavior, high-risk communications, malicious infrastructure, and potential indicators of compromise.
• Independently manage the day-to-day customer mission, including occasional presence on the customer operations floor.
• Prepare and deliver recurring threat briefings, investigative findings, and actionable recommendations to customer SOC and operations leadership.
• Develop and document repeatable threat-hunting tradecraft, playbooks, analytic workflows, and reporting practices.
• Prototype Splunk/SIEM queries and dashboards, lightweight scripts, visualizations, and new hunt concepts to improve threat detection and analysis.
• Translate threat-hunting tradecraft into functional and analytic requirements for developers, engineers, and data scientists.
• Collaborate with AT&T analysts, intelligence teams, developers, and data scientists to advance threat-hunting methods and customer capabilities.
• Mentor other analysts and contribute to peer reviews, knowledge sharing, and continuous improvement.

Required Clearance: TS/SCI with polygraph. (#ts/sci) (#polygraph)

Additional Clearance Requirements:

U.S. citizenship; customer-required polygraph; clearance, polygraph, and customer access eligibility must be maintained.

Required Qualifications:

• Bachelor's degree or equivalent work experience in cybersecurity, computer science, information technology, data science, intelligence studies, mathematics, or similar discipline
• Minimum of 3 to 5 years of experience in threat hunting, network security analysis, cyber threat intelligence, incident investigation, or a related analytical discipline.
• Demonstrated ability to conduct proactive, hypothesis-driven investigations across large datasets, particularly when information is incomplete or does not match a predefined alert.
• Strong knowledge of TCP/IP, Internet infrastructure, and network behavior, with hands‑on experience analyzing NetFlow, DNS, or comparable network metadata.
• Experience using Splunk or another analytics or SIEM platform to query, correlate, investigate, and visualize security data.
• Knowledge of attacker behavior, threat intell