Principal Cybersecurity - Threat Hunter (Government)

AT&T is seeking an experienced and intellectually curious Principal Cybersecurity - Threat Hunter to support a Federal National Security customer. This is not a traditional alert-monitoring or ticket-processing position. The successful candidate will proactively investigate large-scale network metadata, including NetFlow and DNS, develop and test hypotheses, identify meaningful patterns in ambiguous data, and translate technical evidence into clear, actionable intelligence. The successful candidate will synthesize analytic reports, assess their significance and limitations, and connect the findings into an understanding of threats and customer risk. The threat hunter will independently lead day-to-day mission support while working alongside a cross-functional cybersecurity team including data scientists, analysts, software developers, and security engineers. The role requires someone who enjoys finding the story within complex data, challenging initial assumptions, and pursuing investigative leads that may not be identified through predefined rules or traditional security alerts.   This position will leverage AT&T's global network visibility, threat intelligence, analytics, and cybersecurity expertise to identify and investigate emerging threats. Approximately 50% of the role will focus on threat hunting, investigations, reporting, and customer briefings. The remaining time will support advancing threat-hunting tradecraft, evaluating new sources of threat intelligence, analytic prototyping, research and development, and peer collaboration.   This is a full-time onsite role based in the location(s) posted and is performed from the designated work location five days per week. No relocation is offered.   The position is primarily based at AT&T's Chantilly, Virginia office, with occasional presence expected at the customer site. The role generally operates during standard business hours. Description of Job Duties/Responsibilities: • Lead threat analysis and investigations using AT&T Internet traffic metadata, including NetFlow, DNS, and related network telemetry. • Identify anomalous behavior, high-risk communications, malicious infrastructure, and potential indicators of compromise. • Independently manage the day-to-day customer mission, including occasional presence on the customer operations floor. • Prepare and deliver recurring threat briefings, investigative findings, and actionable recommendations to customer SOC and operations leadership. • Develop and document repeatable threat-hunting tradecraft, playbooks, analytic workflows, and reporting practices. • Prototype Splunk/SIEM queries and dashboards, lightweight scripts, visualizations, and new hunt concepts to improve threat detection and analysis. • Translate threat-hunting tradecraft into functional and analytic requirements for developers, engineers, and data scientists. • Collaborate with AT&T analysts, intelligence teams, developers, and data scientists to advance threat-hunting methods and customer capabilities. • Mentor other analysts and contribute to peer reviews, knowledge sharing, and continuous improvement.   Required Clearance: TS/SCI with polygraph. (#ts/sci) (#polygraph) Additional Clearance Requirements: U.S. citizenship; customer-required polygraph; clearance, polygraph, and customer access eligibility must be maintained. Required Qualifications: • Bachelor’s degree or equivalent work experience in cybersecurity, computer science, information technology, data science, intelligence studies, mathematics, or similar discipline • Minimum of 3 to 5 years of experience in threat hunting, network security analysis, cyber threat intelligence, incident investigation, or a related analytical discipline. • Demonstrated ability to conduct proactive, hypothesis-driven investigations across large datasets, particularly when information is incomplete or does not match a predefined alert. • Strong knowledge of TCP/IP, Internet infrastructure, and network behavior, with hands-on experience analyzing NetFlow, DNS, or comparable network metadata. • Experience using Splunk or another analytics or SIEM platform to query, correlate, investigate, and visualize security data. • Knowledge of attacker behavior, threat intelligence, indicators of compromise, and adversary tactics, techniques, and procedures. • Ability to identify meaningful patterns and anomalies, evaluate competing explanations, and distinguish observed facts from analytic judgments. • Strong written and verbal communication skills, including experience presenting technical findings, confidence assessments, and actionable recommendations to customer security and operations leaders. • Ability to independently manage a customer-facing engagement while collaborating effectively with analysts, intelligence teams, engineers, developers, and data scientists. • Ability to prototype queries, lightweight scripts, or analytic workflows and translate investigative needs into clear technical requirements. • Working knowledge of Linux and command-line analysis tools.   Desired Qualifications: • Experience using threat intelligence platforms and sources such as MISP, OSINT, government, or commercial intelligence. • Experience tracking threat actors, malicious infrastructure, botnets, command-and-control activity, proxies, scanning, beaconing, or exploitation behavior. • Experience developing threat-hunting playbooks, mapping findings to MITRE ATT&CK, and converting investigations into repeatable methods. • Familiarity with Python, SQL, shell scripting, statistical baselining, anomaly analysis, data visualization, or evaluating AI/ML-assisted analytics. • Academic or professional exposure to economics, philosophy, intelligence analysis, or another discipline emphasizing critical reasoning, hypothesis development, pattern recognition, and evidence-based argumentation. • Experience supporting Federal or National Security customers, working in classified environments, or operating alongside customer SOC and operations teams. • Relevant cybersecurity certifications such as CISSP, Security+, CySA+, GIAC, Splunk, or comparable credentials.   Ready to join our team? Apply today! Our Principal Cybersecurity - Threat Hunter (Government) earns $130,700 - $205,000 yearly. Not to mention all the other amazing rewards that working at AT&T offers. Individual starting salary within this range may depend on geography, experience, expertise, and education/training. Joining our team comes with amazing perks and benefits: Medical/Dental/Vision coverage 401(k) plan Tuition reimbursement program Paid Time Off and Holidays (based on date of hire, at least 23 days of vacation each year and 9 company-designated holidays) *Pro-rated when working less than 40 hrs/wk. Paid Parental Leave Paid Caregiver Leave Additional sick leave beyond what state and local law require may be available but is unprotected · Adoption Reimbursement Disability Benefits (short term and long term) Life and Accidental Death Insurance Supplemental benefit programs: critical illness/accident hospital indemnity/group legal Employee Assistance Programs (EAP) Extensive employee wellness programs Employee discounts up to 50% off on eligible AT&T mobility plans and accessories, AT&T internet (and fiber where available) and AT&T wireline phone Weekly Hours: 40 Time Type: Regular Location: Chantilly, Virginia