Principal Cybersecurity - Threat Hunter (Government)

AT&T Global Public Sector is a trusted provider of secure, IP-enabled, cloud-based network solutions and professional services to the Federal Government. We are dedicated to recruiting, developing, and empowering a diverse, high-performing workforce that is passionate about what they do, committed to our shared values, and dedicated to our customers' missions. AT&T Public Sector's National Security organization delivers mission-critical solutions supporting the nation's most important priorities. We serve customers across the Department of Defense, Department of Homeland Security, Defense Industrial Base, and Intelligence Community, combining AT&T's technology, global network capabilities, and experienced professionals to support highly sensitive and complex missions. AT&T is seeking an experienced and intellectually curious Principal Cybersecurity - Threat Hunter to support a Federal National Security customer. This is not a traditional alert-monitoring or ticket-processing position. The successful candidate will proactively investigate large-scale network metadata, including NetFlow and DNS, develop and test hypotheses, identify meaningful patterns in ambiguous data, and translate technical evidence into clear, actionable intelligence. The successful candidate will synthesize analytic reports, assess their significance and limitations, and connect the findings into an understanding of threats and customer risk.   The threat hunter will independently lead day-to-day mission support while working alongside a cross-functional cybersecurity team including data scientists, analysts, software developers, and security engineers. The role requires someone who enjoys finding the story within complex data, challenging initial assumptions, and pursuing investigative leads that may not be identified through predefined rules or traditional security alerts.   This position will leverage AT&T's global network visibility, threat intelligence, analytics, and cybersecurity expertise to identify and investigate emerging threats. Approximately 50% of the role will focus on threat hunting, investigations, reporting, and customer briefings. The remaining time will support advancing threat-hunting tradecraft, evaluating new sources of threat intelligence, analytic prototyping, research and development, and peer collaboration.   This is a full-time onsite role based in the location(s) posted and is performed from the designated work location five days per week. No relocation is offered.   The position is primarily based at AT&T's Chantilly, Virginia office, with occasional presence expected at the customer site. The role generally operates during standard business hours. Description of Job Duties/Responsibilities: • Lead threat analysis and investigations using AT&T Internet traffic metadata, including NetFlow, DNS, and related network telemetry. • Identify anomalous behavior, high-risk communications, malicious infrastructure, and potential indicators of compromise. • Independently manage the day-to-day customer mission, including occasional presence on the customer operations floor. • Prepare and deliver recurring threat briefings, investigative findings, and actionable recommendations to customer SOC and operations leadership. • Develop and document repeatable threat-hunting tradecraft, playbooks, analytic workflows, and reporting practices. • Prototype Splunk/SIEM queries and dashboards, lightweight scripts, visualizations, and new hunt concepts to improve threat detection and analysis. • Translate threat-hunting tradecraft into functional and analytic requirements for developers, engineers, and data scientists. • Collaborate with AT&T analysts, intelligence teams, developers, and data scientists to advance threat-hunting methods and cus