Principal Cybersecurity Threat Hunter – TS/SCI

AT&T Mobility Services; Chantilly (VA); On-site; USD 150,000 - 190,000; Full time

Job summary

AT&T Public Sector seeks a Principal Cybersecurity Threat Hunter in Chantilly, VA. You will lead proactive investigations, analyze NetFlow/DNS metadata, and translate findings into actionable intelligence for a cross-functional team.

You will mentor analysts, develop playbooks, and deliver customer briefings while maintaining TS/SCI with polygraph clearance. Onsite five days a week with occasional customer-site presence.

Qualifications

• Bachelor's degree or equivalent in cybersecurity, computer science, information technology, data science, intelligence studies, mathematics, or similar discipline.
• Minimum 3–5 years in threat hunting, network security analysis or related analytical discipline.
• Proactive, hypothesis-driven investigations across large datasets with incomplete information.
• Strong knowledge of TCP/IP, Internet infrastructure and network behavior.
• Experience using Splunk or another SIEM to query, correlate, investigate and visualize security data.
• Knowledge of attacker behavior and threat intelligence.

Responsibilities

• Lead threat analysis and investigations using network metadata (NetFlow, DNS) and related telemetry.
• Identify anomalous behavior, high-risk communications, malicious infrastructure, and indicators of compromise.
• Manage day-to-day customer mission with occasional customer-site presence.
• Prepare and deliver recurring threat briefings, findings, and actionable recommendations to customer leadership.
• Develop repeatable threat-hunting tradecraft, playbooks, workflows, and reporting practices.
• Prototype queries, dashboards, scripts, and visualizations to improve threat detection.
• Translate hunt tradecraft into analytic requirements for engineers and data scientists.
• Collaborate with analysts, intelligence teams, developers, and data scientists to advance methods.
• Mentor analysts and contribute to peer reviews and knowledge sharing.

Skills

Threat hunting

Incident investigation

NetFlow/DNS analysis

Splunk/SIEM

TCP/IP knowledge

Data analysis

Education

Bachelor's degree or equivalent in cybersecurity / CS / IT

Tools

Splunk

Job description

AT&T Public Sector seeks a Principal Cybersecurity Threat Hunter in Chantilly, VA. You will lead proactive investigations, analyze NetFlow/DNS metadata, and translate findings into actionable intelligence for a cross-functional team.

You will mentor analysts, develop playbooks, and deliver customer briefings while maintaining TS/SCI with polygraph clearance. Onsite five days a week with occasional customer-site presence.