Detection Engineer

About the role You will create and validate the detection content that protects our customers: IDPS signatures, application control rules, and DLP rules. This is a hands-on role in our security lab, where you will generate real attack traffic, research vulnerabilities and applications, and make sure every rule is accurate, effective, and ready for production.What you'll doWrite security rulesWrite IDPS signatures for exploits, malware, command-and-control traffic, and network attacks, with the right severity, action (alert / block / reject), and protocol scopeBuild application control rules to identify and control social media, streaming, file sharing, remote access, unsanctioned SaaS, and AI toolsCreate DLP rules to detect sensitive data (personal and financial data, confidential documents, source code) across web, email, and file transfer channelsTest and validateSet up test scenarios in our lab and generate traffic using browsers, command-line tools, packet captures, and safe proof-of-concept exploitsConfirm that each rule triggers and that logs show the correct rule, severity, action, and sourceTest against normal everyday traffic to find and fix false positives before rules shipBuild and maintain a repeatable test set so rules keep working after product updatesResearch and documentTrack new CVEs, exploit techniques, and emerging applications, and turn them into working detectionsStudy public rStudy public rulesets to learn coverage patterns and find gaps in our ownWrite a short validation note for each batch: what it detects, how it was tested, and what it doesn't coverWhat we're looking for2-5 years of hands-on experience writing detection rules or signatures with Snort, Suricata, Zeek, YARA, Sigma, or similarStrong networking fundamentals: TCP/IP, HTTP/HTTPS, DNS, TLS, and packet analysis with Wireshark or pcap toolsExperience testing rules with PoC exploits and tuning them to reduce false positivesExposure to CVE and vulnerability research, with the ability to read advisories and turn them into detectionsWorking knowledge of Python or Bash for test automation, and comfort with LinuxClear written communication, since you'll document what each rule covers and what it doesn'tGood to haveExperience with deep packet inspection, application identification (nDPI or similar), or DLP regex and pattern workBackground at a network security vendor (firewall, IPS, NGFW, secure web gateway)Public work such as GitHub rules, blog posts, CVE credits, or CTF participationThis role is not A SOC monitoring, alert triage, or pure penetration testing role. We are looking for people who write and test detection rules.