Principal AI Security & Detections Engineer

Palo Alto Networks; California (MO); Hybrid; USD 156,000 - 253,000; Full time

Job summary

Palo Alto Networks is building a brand-new AIRS initiative focused on state-of-the-art AI/ML infrastructure and high‑performance, distributed backend systems. This role is hybrid, on-site 3x/week at our Santa Clara, CA headquarters.

As a Security / Detection Engineer, you will analyze multi‑stage attack behavior, craft deterministic signatures, own the detection lifecycle, and collaborate with threat research and inline ML teams to strengthen our AI security platform.

Qualifications

• BS/MS in Computer Science, Cyber Security, or equivalent practical experience with 8+ years in detection engineering, threat analysis, or security research.
• Deep expertise in writing and optimizing signature-based patterns.
• Thorough understanding of application-layer evasion techniques.
• Strong knowledge of detection-as-code and automated testing pipelines for signature validation.
• Scripting with Python, Regex, or similar tools to automate threat telemetry and rule creation.
• Solid understanding of MITRE ATT&CK and translating techniques into defensive controls.

Responsibilities

• Analyze multi-stage attack behavior sequences and translate them into precise, deterministic signatures.
• Develop and maintain high-performance signatures for inline engines with minimal impact on throughput.
• Own the signature lifecycle from research to deployment, regression testing, and deprecation.
• Drive FP tuning and validation to reduce alerts while maximizing true positives.
• Implement version pinning and dependency management for threat content updates across distributed deployments.
• Collaborate with threat research groups and inline ML teams to integrate signatures with classifiers.

Skills

Signature development

Evasion defense

Detection-as-code

Scripting: Python/Regex

MITRE ATT&CK awareness

Education

BS/MS in Computer Science or Cyber Security

Tools

Python

Regex

Job description

Palo Alto Networks is building a brand-new AIRS initiative focused on state-of-the-art AI/ML infrastructure and high‑performance, distributed backend systems. This role is hybrid, on-site 3x/week at our Santa Clara, CA headquarters.

As a Security / Detection Engineer, you will analyze multi‑stage attack behavior, craft deterministic signatures, own the detection lifecycle, and collaborate with threat research and inline ML teams to strengthen our AI security platform.