> Markdown version of [/jobs/ext/4282851-principal-cybersecurity-threat-hunter-government](https://www.wearedevelopers.com/jobs/ext/4282851-principal-cybersecurity-threat-hunter-government). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Principal Cybersecurity - Threat Hunter (Government)

- **Company:** AT&T Inc.
- **Location:** Chantilly, VA, United States
- **Experience:** Experienced
- **Salary:** $130,700 - $205,000
- **Contract:** Permanent contract
- **Skills:** Artificial Intelligence, Big Data, Botnet, Command-Line Interface, CompTIA Security+, Cyber Security, Data Visualization, Linux, Domain Name System (DNS), Intelligence Analysis, Python (Programming Language), Network Security, NetFlow, Network Architecture, Open Source Intelligence, Pattern Recognition, Shell Script, Security Information and Event Management, SQL Databases, TCP/IP, Mitre Att&ck, Cyber Threat Analysis, Information Technology, Cybercrime, Splunk
- **Published:** October 31, 2026
- **Apply:** https://www.clearancejobs.com/jobs/9280762/principal-cybersecurity-threat-hunter-government

## About the Role

* Bachelor's degree or equivalent work experience in cybersecurity, computer science, information technology, data science, intelligence studies, mathematics, or similar discipline
 * Minimum of 3 to 5 years of experience in threat hunting, network security analysis, cyber threat intelligence, incident investigation, or a related analytical discipline.
 * Demonstrated ability to conduct proactive, hypothesis-driven investigations across large datasets, particularly when information is incomplete or does not match a predefined alert.
 * Strong knowledge of TCP/IP, Internet infrastructure, and network behavior, with hands-on experience analyzing NetFlow, DNS, or comparable network metadata.
 * Experience using Splunk or another analytics or SIEM platform to query, correlate, investigate, and visualize security data.
 * Knowledge of attacker behavior, threat intelligence, indicators of compromise, and adversary tactics, techniques, and procedures.
 * Ability to identify meaningful patterns and anomalies, evaluate competing explanations, and distinguish observed facts from analytic judgments.
 * Strong written and verbal communication skills, including experience presenting technical findings, confidence assessments, and actionable recommendations to customer security and operations leaders.
 * Ability to independently manage a customer-facing engagement while collaborating effectively with analysts, intelligence teams, engineers, developers, and data scientists.
 * Ability to prototype queries, lightweight scripts, or analytic workflows and translate investigative needs into clear technical requirements.
 * Working knowledge of Linux and command-line analysis tools., * Experience using threat intelligence platforms and sources such as MISP, OSINT, government, or commercial intelligence.
 * Experience tracking threat actors, malicious infrastructure, botnets, command-and-control activity, proxies, scanning, beaconing, or exploitation behavior.
 * Experience developing threat-hunting playbooks, mapping findings to MITRE ATT&CK, and converting investigations into repeatable methods.
 * Familiarity with Python, SQL, shell scripting, statistical baselining, anomaly analysis, data visualization, or evaluating AI/ML-assisted analytics.
 * Academic or professional exposure to economics, philosophy, intelligence analysis, or another discipline emphasizing critical reasoning, hypothesis development, pattern recognition, and evidence-based argumentation.
 * Experience supporting Federal or National Security customers, working in classified environments, or operating alongside customer SOC and operations teams.
 * Relevant cybersecurity certifications such as CISSP, Security+, CySA+, GIAC, Splunk, or comparable credentials.

Ready to join our team? Apply today!

## Description

* Lead threat analysis and investigations using AT&T Internet traffic metadata, including NetFlow, DNS, and related network telemetry.
 * Identify anomalous behavior, high-risk communications, malicious infrastructure, and potential indicators of compromise.
 * Independently manage the day-to-day customer mission, including occasional presence on the customer operations floor.
 * Prepare and deliver recurring threat briefings, investigative findings, and actionable recommendations to customer SOC and operations leadership.
 * Develop and document repeatable threat-hunting tradecraft, playbooks, analytic workflows, and reporting practices.
 * Prototype Splunk/SIEM queries and dashboards, lightweight scripts, visualizations, and new hunt concepts to improve threat detection and analysis.
 * Translate threat-hunting tradecraft into functional and analytic requirements for developers, engineers, and data scientists.
 * Collaborate with AT&T analysts, intelligence teams, developers, and data scientists to advance threat-hunting methods and customer capabilities.
 * Mentor other analysts and contribute to peer reviews, knowledge sharing, and continuous improvement.

Required Clearance: TS/SCI with polygraph. (#ts/sci) (#polygraph)

Additional Clearance Requirements:

U.S. citizenship; customer-required polygraph; clearance, polygraph, and customer access eligibility must be maintained.