Senior Principal Security & Detection Engineer

Palo Alto Networks; Santa Clara (CA); On-site; USD 184,000 - 297,000; Full time

Job summary

Palo Alto Networks is seeking a Security / Detection Engineer in Santa Clara to own the end-to-end detection lifecycle, translating multi-stage attack patterns into precise signatures and ensuring high-performance enforcement across inline engines.

The role requires 4+ years in detection engineering, deep knowledge of signatures (Snort/Suricata, Yara, PAN-OS), and proficiency in Python/Regex, with a strong MITRE ATT&CK background and evasion techniques understanding.

Qualifications

• BS/MS in Computer Science, Cyber Security, or equivalent practical experience.
• 4+ years of dedicated experience in detection engineering, threat analysis, or security research.
• Deep expertise in writing and optimizing signature-based patterns (e.g., custom Snort/Suricata rules, Yara, PAN-OS custom threat signatures).
• Thorough understanding of application-layer evasion techniques.
• Strong knowledge of the detection-as-code philosophy and building automated testing pipelines for signature validation.
• Experience with Python, Regex, or other scripting tools to automate packet capture analysis, rule creation, and parsing threat telemetry.
• Solid understanding of the MITRE ATT&CK framework and translating offensive techniques into robust defensive controls.

Responsibilities

• Analyze complex, multi-stage attack behavior sequences and transform them into precise, deterministic signatures.
• Develop and maintain high-performance, signatures that can be safely enforced by our inline engines without impacting network throughput.
• Own the entire signature lifecycle, from initial research and threat modeling to deployment, automated regression testing, and deprecation.
• Drive continuous False Positive (FP) tuning and validation processes to minimize alert fatigue while maximizing true positive detection rates.
• Implement robust version pinning strategies and dependency management for threat prevention content updates, ensuring consistency across distributed firewall deployments.
• Partner with threat research groups and inline machine learning teams to integrate behavioral signatures with automated deep learning classifiers.

Skills

Detection engineering

Threat analysis

Signature patterns

Python/Regex

MITRE ATT&CK

Threat modeling

Education

BS/MS in Computer Science or Cyber Security

Tools

Snort/Suricata

Yara

PAN-OS signatures

Job description

Palo Alto Networks is seeking a Security / Detection Engineer in Santa Clara to own the end-to-end detection lifecycle, translating multi-stage attack patterns into precise signatures and ensuring high-performance enforcement across inline engines.

The role requires 4+ years in detection engineering, deep knowledge of signatures (Snort/Suricata, Yara, PAN-OS), and proficiency in Python/Regex, with a strong MITRE ATT&CK background and evasion techniques understanding.