Senior ML Security & Threat Detection Engineer

Palo Alto Networks, Inc.; Santa Clara (CA); On-site; USD 184,000 - 297,000; Full time

Job summary

Palo Alto Networks, Inc. is seeking a Security / Detection Engineer to analyze multi‑stage attack behavior and translate complex threat patterns into deterministic signatures.

You will own the end‑to‑end detection lifecycle—from rule creation to FP tuning—ensuring the defenses remain performant and resilient against evasion. Based at our Santa Clara headquarters, this role emphasizes collaboration across threat research and inline ML teams to integrate behavioral signatures with automated

Qualifications

• BS/MS in Computer Science, Cyber Security, or equivalent practical experience.
• 4+ years in detection engineering, threat analysis, or security research.
• Expertise in writing and optimizing signature-based patterns (e.g., Snort/Suricata rules, Yara).
• Understanding of application-layer evasion techniques.
• Experience with Python, Regex, or scripting to automate threat analysis.
• Knowledge of MITRE ATT&CK framework and translating techniques into controls.

Responsibilities

• Analyze multi-stage attack behavior sequences and transform them into precise, deterministic signatures.
• Develop high‑performance signatures that can be safely enforced by inline engines without impacting throughput.
• Own the signature lifecycle from initial research to deployment and automated regression testing.
• Drive continuous FP tuning and validation to minimize alerts while maximizing true positives.
• Implement version pinning and dependency management for threat content updates.
• Collaborate with threat research groups and inline ML teams to integrate behavioral signatures with classifiers.

Skills

Threat analysis

Signature development

Detection engineering

Threat modeling

Automation scripting

Education

BS/MS in Computer Science

equivalent practical experience

Tools

Python

Regex

Snort

Suricata

Yara

Job description

Palo Alto Networks, Inc. is seeking a Security / Detection Engineer to analyze multi‑stage attack behavior and translate complex threat patterns into deterministic signatures.

You will own the end‑to‑end detection lifecycle—from rule creation to FP tuning—ensuring the defenses remain performant and resilient against evasion. Based at our Santa Clara headquarters, this role emphasizes collaboration across threat research and inline ML teams to integrate behavioral signatures with automated