Lead Security & ML Detection Engineer

Jobs Paloaltonetworks; California (MO); On-site; USD 184,000 - 297,000; Full time

Job summary

Palo Alto Networks is seeking a Security / Detection Engineer to analyze multi‑stage attack behavior sequences and translate them into deterministic signatures. You will own the end‑to‑end detection lifecycle—from rule creation to FP tuning—ensuring our defense mechanisms are performant and resilient against evasion.

You will collaborate with threat research groups and inline ML teams to integrate behavioral signatures with classifiers, maintain high‑performance signatures, and drive deployment

Qualifications

• BS/MS in Computer Science, Cyber Security, or equivalent.
• 4+ years of dedicated experience in detection engineering, threat analysis, or security research.
• Deep expertise in writing and optimizing signature‑based patterns (e.g., custom Snort/Suricata rules, Yara, PAN‑OS custom threat signatures).
• Thorough understanding of application‑layer evasion techniques.
• Strong knowledge of the detection‑as‑code philosophy and building automated testing pipelines for signature validation.
• Experience with Python, Regex, or other scripting tools to automate packet capture analysis, rule creation, and parsing threat telemetry.
• Solid understanding of the MITRE ATT&CK framework and translating offensive techniques into robust defensive controls.

Responsibilities

• Analyze multi‑stage attack behavior sequences and transform them into precise, deterministic signatures.
• Develop and maintain high‑performance, signatures that can be safely enforced by our inline engines without impacting network throughput.
• Own the entire signature lifecycle, from initial research and threat modeling to deployment, automated regression testing, and deprecation.
• Drive continuous False Positive (FP) tuning and validation processes to minimize alert fatigue while maximizing true positive detection rates.
• Implement robust version pinning strategies and dependency management for threat prevention content updates, ensuring consistency across distributed firewall deployments.
• Partner with threat research groups and inline machine learning teams to integrate behavioral signatures with automated deep learning classifiers.

Skills

Signature writing

Threat analysis

Python scripting

Regex

MITRE ATT&CK

Evasion techniques

Education

BS/MS in Computer Science or Cyber Security

Tools

Snort/Suricata rules

Yara

PAN-OS signatures

Job description

Palo Alto Networks is seeking a Security / Detection Engineer to analyze multi‑stage attack behavior sequences and translate them into deterministic signatures. You will own the end‑to‑end detection lifecycle—from rule creation to FP tuning—ensuring our defense mechanisms are performant and resilient against evasion.

You will collaborate with threat research groups and inline ML teams to integrate behavioral signatures with classifiers, maintain high‑performance signatures, and drive deployment