Network Detection and Response Engineer, Arista Focus

Job Description

Job DescriptionNetwork Detection & Response (NDR) Engineer - Arista Focus
Remote, USA

Note: MUST be legally authorized to work in the United States.

POSITION SUMMARY:

• We are seeking an experienced Network Detection & Response (NDR) Engineer to lead the deployment, optimization, and operationalization of network threat detection capabilities using the Arista security portfolio
• This role will be responsible for designing and tuning detection strategies, implementing effective alerting mechanisms, reducing false positives, integrating alerts with Security Operations Center (SOC) workflows, and automating incident response actions across Arista platforms and enterprise systems
• The ideal candidate combines strong network engineering expertise with cybersecurity operations experience, particularly in network traffic analysis, threat detection engineering, security automation, and ITSM integration

KEY RESPONSIBILITIES:
NDR Platform Engineering

• Design, deploy, configure, and maintain Arista NDR and network visibility solutions
• Develop network detection use cases aligned with organizational security requirements and threat models
• Optimize network telemetry collection, traffic visibility, packet analysis, and behavioral analytics
• Ensure high availability, scalability, and performance of NDR infrastructure

Detection Engineering & Alert Tuning

• Create, test, and maintain detection rules, threat indicators, and behavioral analytics
• Develop alerting strategies that prioritize actionable incidents while minimizing alert fatigue
• Continuously tune alerts and detection logic based on SOC feedback, threat intelligence, and incident trends
• Analyze false-positive and false-negative events and implement improvements
• Establish severity classifications, escalation workflows, and operational runbooks

SOC Integration & Operational Support

• Partner with SOC analysts to improve incident detection, triage, and response effectiveness
• Develop alert enrichment processes to provide analysts with actionable context
• Define KPIs and metrics related to alert quality, escalation rates, and detection effectiveness
• Participate in threat hunting activities and post-incident reviews

Automation & Orchestration

• Design and implement automated response workflows utilizing Arista APIs and automation frameworks.
• Automate alert enrichment, ticket creation, incident correlation, and response actions.
• Develop integrations between Arista platforms, SIEM solutions, and ITSM systems.
• Create automated containment and remediation workflows where appropriate.

ServiceNow Integration

• Integrate NDR-generated alerts with ServiceNow Incident Management and Security Operations workflows
• Build and maintain incident creation, assignment, escalation, and closure automation
• Develop bidirectional integrations to update incidents based on security investigation outcomes
• Create dashboards and report to track detection performance and response metrics

Continuous Improvement

• Evaluate emerging threats and adapt detection content accordingly
• Recommend enhancements to network visibility, monitoring, and response processes
• Maintain technical documentation, architecture diagrams, and operational procedures
• Mentor junior engineers and SOC personnel on network threat detection best practices

REQUIRED QUALIFICATIONS:

• Bachelor's degree in Computer Science, Information Security, Network Engineering, or equivalent experience
• At least 5+ years of experience in network security, cybersecurity operations, or detection engineering
• At least 3+ years of experience with Arista networking and security platforms
• Strong understanding of:
  • TCP/IP, DNS, HTTP/S, routing, switching, and network architectures
  • Network threat detection methodologies
  • Security operations and incident response processes
  • Security monitoring, SIEM platforms, and alert lifecycle management
• Experience designing and tuning security alerts in operational SOC environments
• Experience reducing false positives and improving detection fidelity
• Experience with REST APIs, automation scripting, and workflow orchestration
• Proficiency with Python, PowerShell, or similar automation languages
• Experience integrating security platforms with ServiceNow
• Strong analytical, troubleshooting, and communication skills

PREFERRED QUALIFICATIONS:
Hands-on experience with:

• Arista NDR platforms
• Arista CloudVision
• Arista DANZ Monitoring Fabric (DMF)
• Arista MSS or related security analytics technologies

Experience with:

• SIEM platforms (Microsoft Sentinel, Splunk, QRadar, Elastic)
• SOAR platforms and automated incident response
• Threat intelligence integration
• Detection engineering frameworks
• MITRE ATT&CK mapping

Familiarity with:

• ServiceNow Security Operations (SecOps)
• ServiceNow Incident Management
• ITSM workflow automation
• Python-based API integrations
• Infrastructure as Code and DevOps practices

Relevant certifications preferred:

• Arista certifications
• CISSP
• GCIA
• GCIH
• CCNP Security
• Microsoft Security certifications

DESIRED TECHNICAL COMPETENCIES:
Detection Engineering

• Alert architecture and lifecycle management
• Threat modeling
• Behavioral analytics tuning
• Threat hunting
• Detection validation

Automation

• API development
• Python scripting
• Workflow orchestration
• Event-driven automation
• Automated response playbooks

Platform Integration

• Arista ecosystem integration
• ServiceNow integration development
• SIEM connectivity
• Ticketing automation
• Security data enrichment

SUCCESS METRICS:
The successful candidate will:

• Improve alert fidelity and reduce false-positive rates.
• Increase SOC efficiency through automation and alert enrichment.
• Accelerate mean time to detect (MTTD) and mean time to respond (MTTR).
• Develop scalable integrations between Arista tools, ServiceNow, and security platforms.
• Establish measurable improvements in network threat detection coverage and operational effectiveness.

This role is ideal for an engineer who enjoys bridging networking, cybersecurity operations, and automation to build a highly effective network detection and response program.

We are an equal opportunity employer, and we are an organization that values diversity. We welcome applications from all qualified candidates, including minorities and persons with disabilities.

req26-00728