Detection Engineer

About the role

You will create and validate the detection content that protects our customers: IDPS signatures, application control rules, and DLP rules. This is a hands-on role in our security lab, where you will generate real attack traffic, research vulnerabilities and applications, and make sure every rule is accurate, effective, and ready for production.

What you'll do

Write security rules

Write IDPS signatures for exploits, malware, command-and-control traffic, and network attacks, with the right severity, action (alert / block / reject), and protocol scope

Build application control rules to identify and control social media, streaming, file sharing, remote access, unsanctioned SaaS, and AI tools

Create DLP rules to detect sensitive data (personal and financial data, confidential documents, source code) across web, email, and file transfer channels

Test and validate

Set up test scenarios in our lab and generate traffic using browsers, command-line tools, packet captures, and safe proof-of-concept exploits

Confirm that each rule triggers and that logs show the correct rule, severity, action, and source

Test against normal everyday traffic to find and fix false positives before rules ship

Build and maintain a repeatable test set so rules keep working after product updates

Research and document

Track new CVEs, exploit techniques, and emerging applications, and turn them into working detections

Study public r

Study public rulesets to learn coverage patterns and find gaps in our own

Write a short validation note for each batch: what it detects, how it was tested, and what it doesn't cover

What we're looking for

2-5 years of hands-on experience writing detection rules or signatures with Snort, Suricata, Zeek, YARA, Sigma, or similar

Strong networking fundamentals: TCP/IP, HTTP/HTTPS, DNS, TLS, and packet analysis with Wireshark or pcap tools

Experience testing rules with PoC exploits and tuning them to reduce false positives

Exposure to CVE and vulnerability research, with the ability to read advisories and turn them into detections

Working knowledge of Python or Bash for test automation, and comfort with Linux

Clear written communication, since you'll document what each rule covers and what it doesn't

Good to have

Experience with deep packet inspection, application identification (nDPI or similar), or DLP regex and pattern work

Background at a network security vendor (firewall, IPS, NGFW, secure web gateway)

Public work such as GitHub rules, blog posts, CVE credits, or CTF participation

This role is not

A SOC monitoring, alert triage, or pure penetration testing role. We are looking for people who write and test detection rules.