Note: The job is a remote job and is open to candidates in USA. Optum Tech is a global leader in health care innovation, using data analytics, artificial intelligence, and cybersecurity to improve the health system. The Principal Network Detection & Response Engineer will lead the architecture, deployment, and optimization of enterprise NDR capabilities, develop advanced threat detections, analyze network telemetry, and coordinate rapid cyber threat response across hybrid-cloud and on-premises environments.
Responsibilities
- Lead the strategy, architectural design, and optimization of Network Detection & Response (NDR) and network security monitoring platforms across hybrid enterprise environments
- Develop, test, and tune high-fidelity detection signatures, behavioral rules, and anomaly detection models to identify advanced persistent threats (APTs) and zero-day vulnerabilities
- Analyze complex network traffic, packet captures (PCAP), flow data, and encrypted telemetry to uncover evasive malicious activity and lateral movement
- Drive automated response workflows and integration between NDR tools, SIEM, SOAR, and Endpoint Detection & Response (EDR) platforms to minimize Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR)
- Partner with Threat Hunting, Threat Intelligence, and Incident Response teams to translate emerging cyber threat tactics, techniques, and procedures (TTPs) into actionable detections
- Conduct technical reviews, risk assessments, and architectural evaluations of proposed network infrastructure changes to ensure alignment with security detection objectives
- Mentor senior and junior security engineers, providing technical guidance, rule reviews, and subject matter expertise in network defense and threat hunting
Skills
- 5+ years of professional experience in cybersecurity engineering, network security, or intrusion detection/prevention
- 3+ years of hands-on experience deploying, configuring, and tuning Network Detection & Response (NDR) or Network Traffic Analysis (NTA) platforms (e.g., Corelight, Darktrace, ExtraHop, Zeek/Bro, Suricata)
- 3+ years of experience analyzing network protocols (e.g., TCP/IP, DNS, TLS, BGP) and conducting deep packet inspection using tools such as Wireshark, Zeek, or Suricata
- 3+ years of experience integrating network telemetry and security alerts into enterprise SIEM (e.g., Splunk, Sentinel) and SOAR tools
- Industry certifications in information security or network security (e.g., CISSP, GCIA, GCIH, GNFA, CCNP Security)
- Experience engineering security detections for cloud networks and cloud-native services (e.g., AWS VPC Traffic Mirroring, Azure Network Watcher, Google Cloud Platform Packet Mirroring)
- Knowledge of the MITRE ATT&CK framework with demonstrated success mapping network detections to adversary techniques
- Solid background in decrypting or inspecting SSL/TLS traffic and analyzing encrypted network sessions
- Proven ability to communicate complex technical security risks and detection strategies to senior engineering and leadership stakeholders
Benefits
- You'll enjoy the flexibility to work remotely from anywhere within the U.S.
- For all hires in the Minneapolis or Washington, D.C. area, you will be required to work in the office a minimum of four days per week.
- A comprehensive benefits package, subject to eligibility requirements.
- Incentive and recognition programs, subject to eligibility requirements.
- Equity stock purchase, subject to eligibility requirements.
- 401k contribution, subject to eligibility requirements.
- Development for other roles you may be interested in.
Company Overview
Company H1B Sponsorship