Principal Cybersecurity Threat Hunter

What you'll do

• Lead threat analysis and investigations using AT&T Internet traffic metadata, including NetFlow and DNS.
• Identify anomalous behavior, high-risk communications, malicious infrastructure, and potential indicators of compromise.
• Manage day-to-day customer missions and provide occasional presence on the customer operations floor.
• Prepare and deliver recurring threat briefings and actionable recommendations to customer SOC leadership.
• Develop and document repeatable threat-hunting tradecraft, playbooks, and analytic workflows.
• Prototype Splunk queries, dashboards, and lightweight scripts to improve threat detection and analysis.
• Translate threat-hunting tradecraft into functional and analytic requirements for developers and data scientists.
• Mentor other analysts and contribute to peer reviews and knowledge sharing.

What we're looking for

• Must be a U.S. citizen.
• Must possess an active TS/SCI security clearance with a polygraph.
• Bachelor’s degree or equivalent work experience in cybersecurity, computer science, IT, data science, intelligence studies, or a similar discipline.
• Minimum of 3 to 5 years of experience in threat hunting, network security analysis, cyber threat intelligence, or incident investigation.
• Strong knowledge of TCP/IP, Internet infrastructure, and network behavior with hands-on experience analyzing NetFlow and DNS metadata.
• Experience using Splunk or another SIEM platform to query, correlate, investigate, and visualize security data.
• Knowledge of attacker behavior, threat intelligence, indicators of compromise, and adversary tactics, techniques, and procedures.
• Working knowledge of Linux and command-line analysis tools.