Principal Cybersecurity - Threat Hunter (Government)

Location: Chantilly, Virginia, United States; full-time onsite five days per week. Occasional presence at the customer site is expected. No relocation is offered.

Salary: $130,700–$205,000 yearly.

Company

AT&T Global Public Sector provides secure, IP-enabled, cloud-based network solutions and professional services to Federal Government customers, including the Department of Defense, Department of Homeland Security, Defense Industrial Base, and Intelligence Community.

What you will do

• Lead threat analysis and investigations using NetFlow, DNS, and related network telemetry.
• Identify anomalous behavior, high-risk communications, malicious infrastructure, and potential indicators of compromise.
• Manage day-to-day customer mission support and deliver recurring threat briefings, investigative findings, and actionable recommendations.
• Develop threat-hunting playbooks, analytic workflows, reporting practices, and repeatable tradecraft.
• Prototype Splunk/SIEM queries, dashboards, lightweight scripts, visualizations, and new hunt concepts.
• Collaborate with analysts, intelligence teams, developers, engineers, and data scientists; mentor analysts and translate investigative needs into technical requirements.

Requirements

• U.S. citizenship and TS/SCI clearance with polygraph are required; clearance, polygraph, and customer access eligibility must be maintained.
• Bachelor’s degree or equivalent work experience in cybersecurity, computer science, information technology, data science, intelligence studies, mathematics, or a similar discipline.
• 3–5 years of experience in threat hunting, network security analysis, cyber threat intelligence, incident investigation, or a related analytical discipline.
• Ability to conduct proactive, hypothesis-driven investigations across large datasets when information is incomplete or does not match predefined alerts.
• Strong knowledge of TCP/IP, Internet infrastructure, and network behavior, with hands-on experience analyzing NetFlow, DNS, or comparable network metadata.
• Experience using Splunk or another analytics or SIEM platform to query, correlate, investigate, and visualize security data.
• Knowledge of attacker behavior, threat intelligence, indicators of compromise, and adversary tactics, techniques, and procedures.
• Ability to identify meaningful patterns and anomalies, evaluate competing explanations, distinguish observed facts from analytic judgments, and present technical findings and recommendations to customer leaders.
• Ability to independently manage a customer-facing engagement, collaborate across cybersecurity functions, prototype queries or lightweight scripts, and translate investigative needs into technical requirements.
• Working knowledge of Linux and command-line analysis tools.

Nice to have

• Experience with threat intelligence platforms and sources such as MISP, OSINT, government, or commercial intelligence.
• Experience tracking threat actors, malicious infrastructure, botnets, command-and-control activity, proxies, scanning, beaconing, or exploitation behavior.
• Experience developing threat-hunting playbooks, mapping findings to MITRE ATT&CK, and converting investigations into repeatable methods.
• Familiarity with Python, SQL, shell scripting, statistical baselining, anomaly analysis, data visualization, or AI/ML-assisted analytics.
• Academic or professional exposure to economics, philosophy, intelligence analysis, or another discipline emphasizing critical reasoning, hypothesis development, pattern recognition, and evidence-based argumentation.
• Experience supporting Federal or National Security customers, working in classified environments, or operating alongside customer SOC and operations teams.
• Relevant cybersecurity certifications such as CISSP, Security+, CySA+, GIAC, Splunk, or comparable credentials.

Culture & Benefits

• Regular full-time employment with a 40-hour work week during standard business hours.
• Medical, dental, and vision coverage; 401(k); tuition reimbursement; paid time off and holidays.
• At least 23 vacation days per year and 9 company-designated holidays, prorated for schedules below 40 hours per week.
• Paid parental and caregiver leave, sick leave, adoption reimbursement, disability benefits, and life and accidental death insurance.
• Supplemental benefits, employee assistance and wellness programs, and employee discounts on eligible AT&T services and products.