Note: The job is a remote job and is open to candidates in USA. A confidential client is seeking a Network Detection and Response Engineer focused on Arista platforms. The role leads deployment and optimization of network threat detection, tunes alerts, integrates security events with SOC and ServiceNow workflows, and automates incident response.
Responsibilities
- Design, deploy, configure, and maintain Arista NDR and network visibility solutions
- Develop network detection use cases aligned with organizational security requirements and threat models
- Optimize network telemetry collection, traffic visibility, packet analysis, and behavioral analytics
- Ensure high availability, scalability, and performance of NDR infrastructure
- Create, test, and maintain detection rules, threat indicators, and behavioral analytics
- Develop alerting strategies that prioritize actionable incidents while minimizing alert fatigue
- Continuously tune alerts and detection logic based on SOC feedback, threat intelligence, and incident trends
- Analyze false-positive and false-negative events and implement improvements
- Establish severity classifications, escalation workflows, and operational runbooks
- Partner with SOC analysts to improve incident detection, triage, and response effectiveness
- Develop alert enrichment processes to provide analysts with actionable context
- Define KPIs and metrics related to alert quality, escalation rates, and detection effectiveness
- Participate in threat hunting activities and post-incident reviews
- Design and implement automated response workflows utilizing Arista APIs and automation frameworks
- Automate alert enrichment, ticket creation, incident correlation, and response actions
- Develop integrations between Arista platforms, SIEM solutions, and ITSM systems
- Create automated containment and remediation workflows where appropriate
- Integrate NDR-generated alerts with ServiceNow Incident Management and Security Operations workflows
- Build and maintain incident creation, assignment, escalation, and closure automation
- Develop bidirectional integrations to update incidents based on security investigation outcomes
- Create dashboards and report to track detection performance and response metrics
- Evaluate emerging threats and adapt detection content accordingly
- Recommend enhancements to network visibility, monitoring, and response processes
- Maintain technical documentation, architecture diagrams, and operational procedures
- Mentor junior engineers and SOC personnel on network threat detection best practices
Skills
- MUST be legally authorized to work in the United States
- Bachelor's degree in Computer Science, Information Security, Network Engineering, or equivalent experience
- At least 5+ years of experience in network security, cybersecurity operations, or detection engineering
- At least 3+ years of experience with Arista networking and security platforms
- Strong understanding of: + TCP/IP, DNS, HTTP/S, routing, switching, and network architectures + Network threat detection methodologies + Security operations and incident response processes + Security monitoring, SIEM platforms, and alert lifecycle management
- Experience designing and tuning security alerts in operational SOC environments
- Experience reducing false positives and improving detection fidelity
- Experience with REST APIs, automation scripting, and workflow orchestration
- Proficiency with Python, PowerShell, or similar automation languages
- Experience integrating security platforms with ServiceNow
- Strong analytical, troubleshooting, and communication skills
- Arista NDR platforms
- Arista CloudVision
- Arista DANZ Monitoring Fabric (DMF)
- Arista MSS or related security analytics technologies
- SIEM platforms (Microsoft Sentinel, Splunk, QRadar, Elastic)
- SOAR platforms and automated incident response
- Threat intelligence integration
- Detection engineering frameworks
- MITRE ATT&CK mapping
- ServiceNow Security Operations (SecOps)
- ServiceNow Incident Management
- ITSM workflow automation
- Python-based API integrations
- Infrastructure as Code and DevOps practices
- Arista certifications
- CISSP
- GCIA
- GCIH
- CCNP Security
- Microsoft Security certifications
- Alert architecture and lifecycle management
- Threat modeling
- Behavioral analytics tuning
- Threat hunting
- Detection validation
- API development
- Python scripting
- Workflow orchestration
- Event-driven automation
- Automated response playbooks
- Arista ecosystem integration
- ServiceNow integration development
- SIEM connectivity
- Ticketing automation
- Security data enrichment
Benefits
- Remote work
Company Overview