Principal Threat Detection Architect

Palo Alto Networks; San Francisco (CA); On-site; USD 163,000 - 263,000; Full time

Job summary

Palo Alto Networks is seeking a Principal Security Researcher to lead and contribute to the ATP threat detection capabilities across enterprise networks. You will decode protocols, identify applications, and detect threats in real-world environments.

You will propose innovative ideas, own multiple projects, and provide technical leadership to researchers and developers. This hands-on role emphasizes direction-setting and production-quality contributions.

Qualifications

• Deep hands-on experience in vulnerability research, exploit analysis, IPS/IDS detection, offensive security, or closely related threat prevention work.
• Proven ability to identify important technical problems, propose detection ideas, drive execution, and deliver measurable product or customer impact.
• Deep understanding of common vulnerability classes and exploit techniques including memory corruption, injection, authentication bypass, path traversal, SSRF, RCE, XSS, SQL injection, CSRF, MITM, and DoS.
• Strong ability to analyze vulnerability root cause, exploitability, PoC behavior, network traffic, protocol behavior, application-layer attack patterns, and detection tradeoffs.
• Experience translating vulnerability or exploit understanding into production-quality IPS signatures, IDS detections, network detections, or other customer-facing protections.
• Strong understanding of network protocols and application-layer behavior, especially HTTP, DNS, SMB, FTP, SMTP, TCP/UDP, TLS.
• Strong programming or scripting skills for research automation, tooling, test generation, detection development, or pipeline improvements.
• Ability to lead complex technical work under ambiguity, guide other researchers or developers, and make sound technical decisions.
• Experience using AI, ML, automation, or research tooling to improve security analysis, detection development, validation, or response workflows is highly desirable.
• Foundational understanding of AI security scenarios or AI-assisted security workflows is a plus.
• Strong communication skills with the ability to influence technical direction across research, product, QA, and engineering partners.
• BS/MS in Computer Science, Computer Engineering, Cybersecurity, or related field, or equivalent professional experience.

Responsibilities

• Shaping ATP detection strategy by identifying important vulnerability, exploit, and attack technique areas.
• Drive innovative detection ideas from concept to production, delivering measurable improvements in coverage, quality, speed, or scalability.
• Improve rapid response capability for zero-days, high-impact CVEs, and emerging attack vectors.
• Raise the quality and consistency of IPS protections by defining detection approaches, validation, and standards.
• Expand team capability to deliver protections at scale through automation and AI-assisted research workflows.
• Provide hands-on technical leadership through direction, review, and execution guidance.
• Influence cross-functional decisions with product, QA, engineering, and research partners to ensure detections are production-ready.

Skills

Vulnerability research

Exploit analysis

IPS/IDS detection

Offensive security

Threat prevention

Network protocols

Research automation

AI/ML in security

Leadership

Communication

Education

BS/MS in Computer Science or related field

Job description

Palo Alto Networks is seeking a Principal Security Researcher to lead and contribute to the ATP threat detection capabilities across enterprise networks. You will decode protocols, identify applications, and detect threats in real-world environments.

You will propose innovative ideas, own multiple projects, and provide technical leadership to researchers and developers. This hands-on role emphasizes direction-setting and production-quality contributions.