Senior Principal Security Detection Engineer

Jobs Paloaltonetworks; California (MO); On-site; USD 184,000 - 297,000; Full time

Job summary

Palo Alto Networks is hiring a Security / Detection Engineer in Santa Clara, CA. You will analyze multi-stage attack behavior and translate patterns into deterministic signatures, owning the end-to-end detection lifecycle from creation to deployment.

You will develop high-performance signatures for inline enforcement, tune false positives, and partner with threat research and ML teams to enhance content updates across distributed deployments.

Qualifications

• BS/MS in Computer Science, Cyber Security, or equivalent practical experience.
• 4+ years of dedicated experience in detection engineering, threat analysis, or security research.
• Deep expertise in writing and optimizing signature-based patterns (e.g., Snort/Suricata, Yara, PAN-OS).
• Thorough understanding of application-layer evasion techniques.
• Strong knowledge of detection-as-code and automated testing pipelines for signature validation.
• Experience with Python, Regex, or other scripting tools to automate analysis and parsing threat telemetry.
• Solid understanding of the MITRE ATT&CK framework and translating offensive techniques into defensive controls.

Responsibilities

• Analyze multi-stage attack sequences and translate them into deterministic signatures.
• Develop and maintain high-performance signatures safely enforceable by inline engines.
• Own the signature lifecycle from research to deployment and deprecation.
• Drive FP tuning and validation to minimize alerts while maximizing true positives.
• Implement version pinning strategies and dependency management for content updates.
• Collaborate with threat research groups and ML teams to integrate signatures with classifiers.

Skills

Python

Regex

Threat analysis

Education

BS/MS in Computer Science or Cyber Security

Tools

Snort/Suricata rules

Yara

PAN-OS threat signatures

Job description

Palo Alto Networks is hiring a Security / Detection Engineer in Santa Clara, CA. You will analyze multi-stage attack behavior and translate patterns into deterministic signatures, owning the end-to-end detection lifecycle from creation to deployment.

You will develop high-performance signatures for inline enforcement, tune false positives, and partner with threat research and ML teams to enhance content updates across distributed deployments.