Principal Threat Hunter – Federal Cyber Defense

AT&T inc.; Chantilly (VA); On-site; USD 131,000 - 205,000; Full time

Benefits offered by this job

Medical coverage

Dental coverage

Vision coverage

401(k) plan

Tuition reimbursement

Paid time off

Parental leave

Caregiver leave

Adoption reimbursement

Disability benefits

Life Insurance

Employee discounts

Wellness programs

Job summary

AT&T Global Public Sector seeks a Principal Cybersecurity - Threat Hunter in Chantilly, VA. This role leads threat investigations, analyzes NetFlow and DNS metadata, and develops hunting playbooks. Expect collaboration with data scientists, engineers, and security engineers to advance capabilities.

The position is onsite five days a week. Required TS/SCI with polygraph, U.S. citizenship, and 3–5 years of threat hunting experience.

Qualifications

• Proactive, hypothesis-driven threat investigations over large datasets.
• Strong understanding of network protocols and metadata sources.
• Experience explaining technical findings to leadership and customers.

Responsibilities

• Lead threat analysis and investigations using NetFlow, DNS, and related telemetry.
• Identify anomalous behavior and potential indicators of compromise.
• Deliver recurring threat briefings and actionable recommendations to stakeholders.
• Develop repeatable threat-hunting tradecraft and reporting practices.
• Prototype queries and scripts to improve threat detection and analysis.
• Collaborate with cross-functional teams to advance threat-hunting methods.

Skills

Threat hunting

Network metadata analysis

Splunk/SIEM

TCP/IP knowledge

Communication skills

Customer-facing

Education

Bachelor’s degree or equivalent in cybersecurity/CS/IT

Tools

Splunk

SIEM

Job description

AT&T Global Public Sector seeks a Principal Cybersecurity - Threat Hunter in Chantilly, VA. This role leads threat investigations, analyzes NetFlow and DNS metadata, and develops hunting playbooks. Expect collaboration with data scientists, engineers, and security engineers to advance capabilities.

The position is onsite five days a week. Required TS/SCI with polygraph, U.S. citizenship, and 3–5 years of threat hunting experience.