Senior Principal Security Detection Engineer

Palo Alto Networks, Inc.; Santa Clara (CA); On-site; USD 184,000 - 297,000; Full time

Job summary

Palo Alto Networks, Inc. is seeking a Security / Detection Engineer to analyze multi-stage attack behavior and translate complex threat patterns into deterministic signatures.

You will own the end-to-end detection lifecycle—from rule creation to FP tuning—ensuring robust and scalable defenses for our customers. You will develop high-performance signatures for inline engines, drive continuous false-positive tuning, and collaborate with threat research and ML teams to strengthen threat content

Qualifications

• BS/MS in Computer Science, Cyber Security, or equivalent practical experience.
• Signature development expertise and optimization of signature-based patterns.
• Thorough understanding of application-layer evasion techniques.
• Knowledge of detection-as-code and automated testing pipelines.

Responsibilities

• Analyze multi-stage attack behavior sequences and transform them into precise, deterministic signatures.
• Develop and maintain high-performance signatures safe for inline engines without impacting throughput.
• Own the signature lifecycle from research to deployment, testing, and deprecation.
• Drive continuous FP tuning to minimize alerts while maximizing true positives.
• Implement version pinning and dependency management for updates across deployments.
• Collaborate with threat research and ML teams to integrate signatures with classifiers.

Skills

Signature development

Evasion defense

Detection-as-Code

Threat modeling

Python

Education

BS/MS in Computer Science or Cyber Security

Tools

Python

Regex

Job description

Palo Alto Networks, Inc. is seeking a Security / Detection Engineer to analyze multi-stage attack behavior and translate complex threat patterns into deterministic signatures.

You will own the end-to-end detection lifecycle—from rule creation to FP tuning—ensuring robust and scalable defenses for our customers. You will develop high-performance signatures for inline engines, drive continuous false-positive tuning, and collaborate with threat research and ML teams to strengthen threat content