2 days ago
Pune, IndiaStaff+
Responsibilities
- Develop advanced detections and threat-hunting logic using Python and AWS infrastructure.
- Design, scale, and maintain detection engineering projects, GitLab pipelines, and repeatable deployment processes.
- Create YAML-based detections and SIGMA-like rules and migrate existing detections to next-generation systems.
- Use Hadoop, Athena, and data lakes to monitor and test intelligence sources and improve threat visibility.
- Write detections and playbooks independently while supporting operational needs, weekend night shifts, and on-call rotations.
Requirements
- Foundational understanding of AI/ML technologies and experience leveraging, securing, or positioning AI-driven solutions within the functional domain.
- Deep detection experience in at least one of endpoint/MDR, cloud/SaaS, identity, email, or SIEM, with judgment to own that area.
- Demonstrated ownership of technical work end to end and accountability for quality with limited oversight.
- Strong understanding of attacker behavior and fluent use of ATT&CK to determine detection coverage.
- Experience with detector-as-code, version control, code review, and controlled deployment using Git and CI/CD.
- Preferred: experience with AI/ML models, LLMs, or NLP for threat intelligence synthesis, detection-rule generation, or predictive anomaly detection.
- Preferred: programming or scripting with Python, Go, Ruby, or similar languages for detection tooling and automation.
- Preferred: reverse engineering, malware analysis, red-team, or offensive-security experience.
Benefits
- Various health plans, vacation and sick time off plans, parental leave, retirement options, education reimbursement, and in-office perks.
- Hybrid work arrangement in Pune, India.
About Zscaler
Zscaler builds a cloud-delivered zero trust security platform that replaces traditional network security appliances for enterprises and public-sector organizations. Its Zero Trust Exchange provides secure web gateway, zero trust access, CASB, and cloud firewall services, sold as subscriptions and delivered across 160+ global data centers. Founded in 2007 and headquartered in San Jose, it is a public company on NASDAQ (ZS) serving thousands of customers worldwide.