Principal Cybersecurity - Threat Hunter (Government)

About the role

AT&T Global Public Sector, part of its National Security organization serving the Department of Defense, DHS, the Defense Industrial Base and the Intelligence Community, is looking for an experienced Principal Cybersecurity Threat Hunter to support a Federal National Security customer. The role is proactive and investigative, not alert monitoring or ticket processing: it involves investigating large-scale network metadata (NetFlow, DNS), forming hypotheses, spotting patterns in ambiguous data and turning technical evidence into actionable intelligence. It is a full-time onsite position in Chantilly, Virginia, five days a week, with occasional presence at the customer site.

Key responsibilities

• Lead threat analysis and investigations using Internet traffic metadata (NetFlow, DNS, network telemetry) and identify anomalous behavior, high-risk communications, malicious infrastructure and indicators of compromise.
• Independently manage the day-to-day customer mission, including occasional presence on the customer operations floor.
• Prepare and deliver recurring threat briefings, findings and recommendations to the customer SOC and operations leadership.
• Develop and document threat-hunting playbooks, analytic workflows and reporting practices.
• Prototype Splunk/SIEM queries, dashboards, scripts and visualizations, and turn tradecraft into requirements for developers, engineers and data scientists.
• Mentor analysts and contribute to peer reviews and knowledge sharing.

Required profile

• Bachelor's degree or equivalent experience in cybersecurity, computer science, data science, intelligence studies, mathematics or a similar field.
• 3 to 5 years of experience in threat hunting, network security analysis, cyber threat intelligence, incident investigation or a related analytical discipline.
• TS/SCI clearance with polygraph, U.S. citizenship, and customer-required polygraph; clearance must be maintained.
• Strong written and verbal communication, able to present technical findings to customer security and operations leaders.

Required skills

• Hands-on analysis of NetFlow, DNS or comparable network metadata.
• Splunk or another analytics/SIEM platform.
• Knowledge of attacker behavior, TTPs and indicators of compromise.
• Working knowledge of Linux and command-line tools.
• Desired: threat intelligence platforms (MISP, OSINT), MITRE ATT&CK, Python, SQL, shell scripting, and experience with Federal or National Security customers.

What we offer

• Salary of $130,700 - $205,000 per year, depending on experience and expertise.
• Medical, dental and vision coverage, 401(k), tuition reimbursement and paid time off (at least 23 days of vacation and 9 holidays).
• Paid parental and caregiver leave, adoption reimbursement, disability and life insurance, and employee assistance programs.