Network Security Researcher

Software Engineering Institute | Carnegie Mellon University

Arlington (VA)

On-site

USD 120,000 - 160,000

Full time

19 hours ago

Be an early applicant

Get more replies from employers

Send a job-specific resume in minutes.

Job summary

Software Engineering Institute | Carnegie Mellon University seeks a network security researcher for the Network Situational Awareness team. You will analyze network threats and develop detection methods, translating insights into capabilities for NetSA and related tools.

This role involves collaborating with partners to tailor data-driven solutions. You will contribute to publications, gather requirements, and train customers on new features, including host-based and cloud telemetry as the data

Qualifications

Bachelor's degree in Computer Science or a relevant technical discipline with eight (8) years of relevant work experience; or a MS in Computer Science or a relevant technical discipline with five (5) years of relevant work experience; or a PhD in Computer Science or other relevant technical discipline with two (2) years of relevant work experience.
Movement between buildings within the SEI and CMU community required.
Willingness to travel to various locations to support the SEI’s overall mission. This may include national travel to sponsor sites, conferences, and offsite meetings on occasion.
You will be subject to a background check and will need to obtain and maintain a Department of War security clearance.

Responsibilities

Research network threats and develop detection methods.
Tailor research outcomes for partner environments and NetSA tool suite requirements.
Produce publications and provide customer-specific training.
Collaborate with partners to understand data and expand telemetry sources.

Skills

Threat intelligence translation

Network fundamentals

Python

Ruby

Java

Scala

Analytical skills

Documentation/communication

Education

Bachelor's degree in Computer Science

Master's degree in Computer Science

PhD in Computer Science

Tools

NetSA Security tool suite

Zeek

Suricata

YAF

PCAP data analysis

Job description

Our team, within the Cyber Risk and Resilience Directorate researches, designs, and develops software tools for the collection, storage, and analysis of network data to provide security insights. We provide both the core network tools to facilitate this capability, and prototypes of new methods to present the data most effectively. We work with data at a scale generally not experienced by most organizations, handling record counts in the tens of billions per day.

Developing security insights at this scale requires creativity, efficiency, and contemporary knowledge of modern computing platforms. In some cases, the computing has outpaced the methods, and it is incumbent upon us to generate novel views of both the entire data collection, and of focused datasets tailored to specific analyst needs.

Our network situational awareness security tools are published here: https://tools.netsa.cert.org/

Position Summary

As a network security researcher on the Network Situational Awareness team, you will research network threats to develop methods of detection and tailor these for partner environments. Transition of this research will take the form of developing detection capabilities, providing new requirements and feature requests for our NetSA Security tool suite, writing publications, and providing customer-specific training. The primary network data source for the team is netflow combined with application layer metadata, with an expanding focus on host-based (e.g., EDR) and cloud telemetry. You will be responsible for gaining insights from data to facilitate detections, working with partners to help them to better understand their data and researching new data sources to expand the expertise of the team.

Requirements

Bachelor'S Degree in Computer Science or a relevant technical discipline with eight (8) years of relevant work experience; or a MS in Computer Science or a relevant technical discipline with five (5) years of relevant work experience; or a PhD in Computer Science or other relevant technical discipline with two (2) years of relevant work experience.

Movement between buildings within the SEI and CMU community required.

Willingness to travel to various locations to support the SEI’s overall mission. This may include national travel to sponsor sites, conferences, and offsite meetings on occasion.

You will be subject to a background check and will need to obtain and maintain a Department of War security clearance.

Knowledge, Skills And Abilities

Ability to translate threat intelligence to avenues for research, prototyping, and curation of detection capabilities.

Strong knowledge of network fundamentals, common application layer protocols, and network-based telemetry.

Strong proficiency in at least one scripting or programming language such as Python, Go, Ruby, C, Java, or Scala.

Strong problem-solving and analytical skills, detailed research, and ability to document and communicate ideas and findings to diverse audiences.

Desired Experience

Hands-on experience in a security research, threat hunting, detection engineering, or Cyber threat Intelligence (CTI) analyst role.

Experience analyzing large datasets, especially network telemetry such as netflow, application metadata, or PCAP from network sensors such as YAF, Zeek, Suricata, etc;