Network Threat Detection Engineer

SoftServe; Poland; On-site; PLN 180,000 - 280,000; Full time

Job summary

SoftServe is seeking a proactive security data scientist to develop detection logic against real-world telemetry. You will treat detections as code, with versioning, peer review, testing and continuous improvement across network data and platform telemetry.

You will collaborate with threat intelligence teams to convert research into actionable content, build scalable detections on Databricks, and help deploy them in SaaS and on‑prem environments, while enabling threat hunting and investigations.

Qualifications

• Proven experience writing detection content for network threats.
• Strong networking knowledge including TCP/IP, DNS, HTTP/S, TLS.
• Proficient in Python and SQL for data analysis and detection development.
• Experience with Sigma/Snort/Suricata detection formats.

Responsibilities

• Design and build behavioral models to detect malicious network activity.
• Develop detections for beaconing, DGA, data staging, lateral movement, DNS tunneling.
• Translate use cases into production-grade detection logic and indicators.
• Collaborate with threat intel teams to turnkey new content.
• Tune detections using metrics like precision, recall, and MITRE ATT&CK coverage.
• Use Telemetry on Databricks to validate and improve performance.
• Work with engineering to productionize detections in a SaaS service.

Skills

Python

SQL

Network security

Threat detection

Data analysis

MITRE ATT&CK

Education

Bachelor's degree in CS/Engineering

Tools

Sigma

Snort

Suricata

Databricks

Job description

SoftServe is seeking a proactive security data scientist to develop detection logic against real-world telemetry. You will treat detections as code, with versioning, peer review, testing and continuous improvement across network data and platform telemetry.

You will collaborate with threat intelligence teams to convert research into actionable content, build scalable detections on Databricks, and help deploy them in SaaS and on‑prem environments, while enabling threat hunting and investigations.