Principal NDR Engineer: Threat Detection & Response

UnitedHealth-Grou; Eden Prairie (MN); Hybrid; USD 113,000 - 193,000; Full time

Benefits offered by this job

Comprehensive benefits package

Incentive and recognition programs

Equity stock purchase plan

401k contribution

Job summary

UnitedHealth Group is seeking a Principal Network Detection & Response Engineer to lead architecture, deployment, and optimization of enterprise-wide NDR capabilities across hybrid environments.

You will develop high-fidelity detections, analyze network telemetry, and drive automated response with SIEM/SOAR/EDR integrations while collaborating with Threat Hunting and Incident Response teams.

Qualifications

• 5+ years of professional experience in cybersecurity engineering, network security, or intrusion detection/prevention.
• 3+ years deploying and tuning NDR or Network Traffic Analysis platforms (e.g., Corelight, Darktrace, ExtraHop, Zeek/Bro, Suricata).
• 3+ years analyzing network protocols and performing deep packet inspection with Wireshark, Zeek, or Suricata.
• 3+ years integrating network telemetry into enterprise SIEM (e.g., Splunk, Sentinel) and SOAR.
• Industry certifications in information security or network security (e.g., CISSP, GCIA, GCIH, GNFA, CCNP Security).
• Cloud network detections experience (AWS/Azure/GCP) and MITRE ATT&CK mapping knowledge.
• SSL/TLS traffic inspection capabilities and encrypted session analysis.

Responsibilities

• Lead the strategy, design, and optimization of NDR and network security monitoring across hybrid environments.
• Develop, test, and tune high-fidelity detection signatures and anomaly detection models.
• Analyze complex network traffic and PCAP data to uncover malicious activity and lateral movement.
• Drive automated response workflows and integration between NDR, SIEM, SOAR, and EDR.
• Collaborate with Threat Hunting, Threat Intelligence, and Incident Response teams for detections.
• Perform risk assessments and architecture reviews to align with detection objectives.
• Mentor security engineers with technical guidance and rule reviews.

Skills

Cybersecurity engineering

Network security

NDR platforms

Packet analysis

SIEM/SOAR integration

Threat hunting

Mentoring

Education

Information security certifications

Tools

Corelight

Darktrace

ExtraHop

Zeek/Bro

Suricata

Wireshark

Splunk

SOAR

EDR

Job description

UnitedHealth Group is seeking a Principal Network Detection & Response Engineer to lead architecture, deployment, and optimization of enterprise-wide NDR capabilities across hybrid environments.

You will develop high-fidelity detections, analyze network telemetry, and drive automated response with SIEM/SOAR/EDR integrations while collaborating with Threat Hunting and Incident Response teams.