Principal Engineer - Security & Detections (Prisma AIRS)
Palo Alto Networks3 days ago
Base Salary
$156k - $253k/yr
Responsibilities
- Analyze multi-stage attack behavior and translate threat patterns into deterministic signatures.
- Develop and maintain high-performance signatures for inline engines while preserving network throughput.
- Own signature research, threat modeling, deployment, automated regression testing, versioning, tuning, and deprecation.
- Tune and validate detections to reduce false positives and maximize true-positive rates.
- Implement version pinning and dependency management for threat-prevention content across distributed firewall deployments.
- Collaborate with threat research and inline machine learning teams to integrate behavioral signatures with deep learning classifiers.
Requirements
- BS/MS in Computer Science, Cyber Security, or equivalent practical experience.
- 8+ years of dedicated experience in detection engineering, threat analysis, or security research.
- Deep expertise writing and optimizing signature-based patterns.
- Thorough understanding of application-layer evasion techniques.
- Strong knowledge of detection-as-code and automated testing pipelines for signature validation.
- Familiarity with AI risk and threat signatures and OWASP frameworks, including the OWASP Top 10 for LLMs.
- Experience with Python, Regex, or other scripting tools for packet-capture analysis, rule creation, and threat-telemetry parsing.
- Understanding of MITRE ATT&CK and translating offensive techniques into defensive controls.
Benefits
- Hybrid work arrangement with on-site work three days per week at the corporate headquarters in Santa Clara, California.
- Compensation may include restricted stock units and a bonus.
- Employee benefits are available according to the company benefits program.
About Palo Alto Networks
Palo Alto Networks builds cybersecurity products for enterprises and governments, including next-generation firewalls, cloud security (Prisma Cloud/Prisma Access), and SOC tools (Cortex). It sells subscriptions and appliances with cloud-delivered threat intelligence, securing networks, endpoints, and applications across data centers and public clouds. Founded in 2005 and headquartered in Santa Clara, California, the company is publicly traded on the NYSE under the ticker PANW.