Principal Cybersecurity – Threat Hunter

AT&T

. Lead threat analysis and investigations using AT&T Internet traffic metadata, including NetFlow, DNS, and related network telemetry .

Posted 10/30/2026full-timeChantilly • Virginia • United StatesLead💰 $130,700 - $205,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in threat hunting, network security analysis, and incident investigation, with a strong ability to analyze network metadata and develop actionable intelligence. Proficient in collaborating with cross-functional teams to enhance threat detection capabilities and deliver impactful customer briefings.

Highest-signal resume keywords

Threat HuntingNetwork Security AnalysisSplunk/SIEM PrototypingTCP/IP KnowledgeTS/SCI Clearance

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Threat Intelligence EvaluationIncident InvestigationData AnalysisAnomaly DetectionNetwork Metadata AnalysisPlaybook DevelopmentPython ProgrammingSQL ProficiencyShell ScriptingCommand-Line Analysis

Soft Skills

Strong Communication SkillsMentoringCollaborationCustomer Engagement ManagementKnowledge Sharing

Tools & Technologies

SplunkSIEM PlatformsThreat Intelligence PlatformsLinuxMISP

Certifications & Qualifications

CISSPSecurity+CySA+GIACSplunk Certification

Industry Keywords

CybersecurityNetwork BehaviorIndicators of CompromiseAdversary TacticsMITRE ATT&CKFederal SecurityClassified EnvironmentsData VisualizationAI/ML-Assisted AnalyticsProxies and Botnets

Tech Stack

Tools & technologies

Cyber SecurityDNSLinuxPythonShell ScriptingSplunkSQLTCP/IPTypeScript

About the role

Key responsibilities & impact

Lead threat analysis and investigations using AT&T Internet traffic metadata, including NetFlow, DNS, and related network telemetry
Identify anomalous behavior, high-risk communications, malicious infrastructure, and potential indicators of compromise
Independently manage the day-to-day customer mission, including occasional presence on the customer operations floor
Prepare and deliver recurring threat briefings, investigative findings, and actionable recommendations to customer SOC and operations leadership
Develop and document repeatable threat-hunting tradecraft, playbooks, analytic workflows, and reporting practices
Prototype Splunk/SIEM queries and dashboards, lightweight scripts, visualizations, and new hunt concepts to improve threat detection and analysis
Translate threat-hunting tradecraft into functional and analytic requirements for developers, engineers, and data scientists
Collaborate with AT&T analysts, intelligence teams, developers, and data scientists to advance threat-hunting methods and customer capabilities
Mentor other analysts and contribute to peer reviews, knowledge sharing, and continuous improvement
Approximately 50% of the role focuses on threat hunting, investigations, reporting, and customer briefings; remaining time supports tradecraft advancement, threat intelligence evaluation, analytic prototyping, research and development, and peer collaboration

Requirements

What you’ll need

Required Clearance: TS/SCI with polygraph
U.S. citizenship
Customer-required polygraph
Clearance, polygraph, and customer access eligibility must be maintained
Bachelor’s degree or equivalent work experience in cybersecurity, computer science, information technology, data science, intelligence studies, mathematics, or similar discipline
Minimum of 3 to 5 years of experience in threat hunting, network security analysis, cyber threat intelligence, incident investigation, or a related analytical discipline
Ability to conduct proactive, hypothesis-driven investigations across large datasets
Strong knowledge of TCP/IP, Internet infrastructure, and network behavior
Hands-on experience analyzing NetFlow, DNS, or comparable network metadata
Experience using Splunk or another analytics or SIEM platform
Knowledge of attacker behavior, threat intelligence, indicators of compromise, and adversary tactics, techniques, and procedures
Ability to identify meaningful patterns and anomalies, evaluate competing explanations, and distinguish observed facts from analytic judgments
Strong written and verbal communication skills, including presenting technical findings, confidence assessments, and actionable recommendations
Ability to independently manage a customer-facing engagement while collaborating with analysts, intelligence teams, engineers, developers, and data scientists
Ability to prototype queries, lightweight scripts, or analytic workflows and translate investigative needs into clear technical requirements
Working knowledge of Linux and command-line analysis tools
Experience using threat intelligence platforms and sources such as MISP, OSINT, government, or commercial intelligence
Experience tracking threat actors, malicious infrastructure, botnets, command-and-control activity, proxies, scanning, beaconing, or exploitation behavior
Experience developing threat-hunting playbooks, mapping findings to MITRE ATT&CK, and converting investigations into repeatable methods
Familiarity with Python, SQL, shell scripting, statistical baselining, anomaly analysis, data visualization, or evaluating AI/ML-assisted analytics
Experience supporting Federal or National Security customers, working in classified environments, or operating alongside customer SOC and operations teams
Relevant cybersecurity certifications such as CISSP, Security+, CySA+, GIAC, Splunk, or comparable credentials are desired

Benefits

Comp & perks

Medical/Dental/Vision coverage
401(k) plan
Tuition reimbursement program
Paid Time Off and Holidays (at least 23 days of vacation each year and 9 company-designated holidays)
Paid Parental Leave
Paid Caregiver Leave
Additional sick leave beyond what state and local law require may be available
Adoption Reimbursement
Disability Benefits (short term and long term)
Life and Accidental Death Insurance
Supplemental benefit programs: critical illness/accident hospital indemnity/group legal
Employee Assistance Programs (EAP)
Extensive employee wellness programs
Employee discounts up to 50% off on eligible AT&T mobility plans and accessories, AT&T internet (and fiber where available) and AT&T wireline phone