Senior Security ML & Detection Architect

Jobs Paloaltonetworks; United States; On-site; USD 184,000 - 297,000; Full time

Job summary

Palo Alto Networks is seeking a Security / Detection Engineer to analyze multi-stage attack patterns and translate them into deterministic signatures. You will own the end-to-end detection lifecycle, from rule creation to FP tuning, ensuring high performance and resilience against evasion.

As a key contributor, you will collaborate with threat research groups and ML teams, implement robust versioning, and drive automation for signature validation across distributed deployments.

Qualifications

• BS/MS in Computer Science, Cyber Security, or equivalent practical experience.
• 4+ years of dedicated experience in detection engineering, threat analysis, or security research.
• Deep expertise in writing and optimizing signature-based patterns (e.g., Snort/Suricata rules, Yara, PAN-OS signatures).
• Thorough understanding of application-layer evasion techniques.
• Strong knowledge of detection-as-code and automated testing pipelines for signature validation.
• Experience with Python, Regex, or other scripting tools to automate threat analysis.
• Solid understanding of MITRE ATT&CK and translating techniques into defenses.

Responsibilities

• Analyze complex, multi-stage attack behavior sequences and transform them into precise, deterministic signatures.
• Develop and maintain high-performance signatures safely enforced by inline engines without impacting throughput.
• Own the signature lifecycle from research to deployment, testing, and deprecation.
• Drive continuous FP tuning and validation to minimize alert fatigue and maximize true positives.
• Implement version pinning strategies and dependency management for content updates.
• Collaborate with threat research and inline ML teams to integrate signatures with classifiers.

Skills

Detection engineering

Threat analysis

Security research

Python scripting

MITRE ATT&CK

Education

BS/MS in Computer Science or Cyber Security

Tools

Snort/Suricata rules

Yara

PAN-OS threat signatures

Job description

Palo Alto Networks is seeking a Security / Detection Engineer to analyze multi-stage attack patterns and translate them into deterministic signatures. You will own the end-to-end detection lifecycle, from rule creation to FP tuning, ensuring high performance and resilience against evasion.

As a key contributor, you will collaborate with threat research groups and ML teams, implement robust versioning, and drive automation for signature validation across distributed deployments.