Network Security Researcher

Software Engineering Institute | Carnegie Mellon University; Arlington (VA); On-site; USD 120,000 - 160,000; Full time

Job summary

The Network Situational Awareness team at the Software Engineering Institute (Carnegie Mellon University) seeks a network security researcher to study threats and develop detection methods using netflow, application metadata, and evolving telemetry.

Responsibilities include translating threat intelligence into research and prototype features for the NetSA tool suite, publishing findings, and delivering customer-specific training while coordinating with partners across travel to sponsor sites.

Qualifications

• Bachelor’s or higher in CS with 8+ years (or Master’s with 5+; PhD with 2+).
• Willingness to travel regionally and nationally.
• Ability to translate threat intelligence to research and detection capabilities.
• Strong knowledge of network fundamentals and telemetry.

Responsibilities

• Research network threats to develop detection methods.
• Contribute to NetSA tool suite requirements and features.
• Publish findings and provide customer-specific training.
• Work with partners to analyze data for detections.

Skills

Python

Go

Ruby

C

Java

Scala

Network fundamentals

Scripting

Education

Bachelor's Degree in CS

Master's Degree in CS

PhD in CS

Tools

NetSA

YAF

Zeek

Suricata

PCAP Analysis

Job description

What We Do:

Our team, within the Cyber Risk and Resilience Directorate, researches, designs, and develops software tools for the collection, storage, and analysis of network data to provide security insights. We provide both core network tools to facilitate this capability and prototypes of new methods to present the data most effectively. We work with data at a scale generally not experienced by most organizations, handling record counts in the tens of billions per day.

Position Summary:

As a network security researcher on the Network Situational Awareness team, you will research network threats to develop methods of detection and tailor these for partner environments. Transition of this research will take the form of developing detection capabilities, providing new requirements and feature requests for our NetSA Security tool suite, writing publications, and providing customer‑specific training. The primary network data source for the team is netflow combined with application‑layer metadata, with an expanding focus on host‑based (e.g., EDR) and cloud telemetry.

You will be responsible for gaining insights from data to facilitate detections, working with partners to help them better understand their data and researching new data sources to expand the expertise of the team.

Requirements:

• Bachelor’s Degree in Computer Science or a relevant technical discipline with eight (8) years of relevant work experience; or a Master’s Degree in Computer Science or a relevant technical discipline with five (5) years of relevant work experience; or a PhD in Computer Science or other relevant technical discipline with two (2) years of relevant work experience.
• Movement between buildings within the SEI and CMU community required.

Willingness to travel to various locations to support the SEI’s overall mission, including national travel to sponsor sites, conferences, and off‑site meetings on occasion.

You will be subject to a background check and will need to obtain and maintain a Department of War security clearance.

Knowledge, Skills and Abilities:

• Ability to translate threat intelligence to avenues for research, prototyping, and curation of detection capabilities.
• Strong knowledge of network fundamentals, common application‑layer protocols, and network‑based telemetry.
• Strong proficiency in at least one scripting or programming language such as Python, Go, Ruby, C, Java, or Scala.
• Strong problem‑solving and analytical skills, detailed research, and ability to document and communicate ideas and findings to diverse audiences.

Desired Experience:

• Hands‑on experience in a security research, threat hunting, detection engineering, or Cyber Threat Intelligence (CTI) analyst role.
• Experience analyzing large datasets, especially network telemetry such as netflow, application metadata, or PCAP from network sensors such as YAF, Zeek, Suricata, etc.
• Experience applying cybersecurity data science methods and practices.
• Experience using open‑source and/or commercial Internet intelligence telemetry and datasets.
• Strong grasp of the threat landscape and experience researching and investigating threats.
• Experience presenting technical topics.

Location

Arlington, VA; Pittsburgh, PA

Job Function

Software/Applications Development/Engineering

Position Type

Staff – Regular

Full time/Part time

Full time

Pay Basis

Salary

More Information

• Please visit “Why Carnegie Mellon” to learn more about becoming part of an institution inspiring innovations that change the world.
• Click here to view a listing of employee benefits.
• Carnegie Mellon University is an Equal Opportunity Employer / Disability / Veteran.
• Statement of Assurance.