Sr. Principal Engineer Software - Security & Detections

About the Role

As a Security / Detection Engineer, you will analyze multi-stage attack behavior sequences and translate complex threat patterns into highly deterministic signatures. You will own the end-to-end detection lifecycle—from rule creation to continuous false-positive (FP) tuning—ensuring our defense mechanisms are performant, accurate, and resilient against evasion.

Your Impact

• Analyze complex, multi-stage attack behavior sequences and transform them into precise, deterministic signatures.
• Develop and maintain high-performance signatures that can be safely enforced by our inline engines without impacting network throughput.
• Own the entire signature lifecycle, from initial research and threat modeling to deployment, automated regression testing, and deprecation.
• Drive continuous False Positive (FP) tuning and validation processes to minimize alert fatigue while maximizing true positive detection rates.
• Implement robust version pinning strategies and dependency management for threat prevention content updates, ensuring consistency across distributed firewall deployments.
• Partner with threat research groups and inline machine learning teams to integrate behavioral signatures with automated deep learning classifiers.

Qualifications

• BS/MS in Computer Science, Cyber Security, or equivalent practical experience.
• 4+ years of dedicated experience in detection engineering, threat analysis, or security research.
• Deep expertise in writing and optimizing signature-based patterns (e.g., custom Snort/Suricata rules, Yara, PAN-OS custom threat signatures).
• Thorough understanding of application-layer evasion techniques.
• Strong knowledge of the detection-as-code philosophy and building automated testing pipelines for signature validation.
• Experience with Python, Regex, or other scripting tools to automate packet capture analysis, rule creation, and parsing threat telemetry.
• Solid understanding of the MITRE ATT&CK framework and translating offensive techniques into robust defensive controls.

Team

We believe collaboration thrives in person. That's why most of our teams work from the office full time (3 days a week at our Santa Clara headquarters), with flexibility when it's needed. This model supports real-time problem-solving, stronger relationships, and the kind of precision that drives great outcomes.

Pay

$183,600.00 - $297,000.00/yr