Network Detection and Response Engineer, Arista Focus

Job DescriptionJob DescriptionNetwork Detection & Response (NDR) Engineer - Arista Focus Remote, USA Note: MUST be legally authorized to work in the United States. POSITION SUMMARY:We are seeking an experienced Network Detection & Response (NDR) Engineer to lead the deployment, optimization, and operationalization of network threat detection capabilities using the Arista security portfolioThis role will be responsible for designing and tuning detection strategies, implementing effective alerting mechanisms, reducing false positives, integrating alerts with Security Operations Center (SOC) workflows, and automating incident response actions across Arista platforms and enterprise systemsThe ideal candidate combines strong network engineering expertise with cybersecurity operations experience, particularly in network traffic analysis, threat detection engineering, security automation, and ITSM integration KEY RESPONSIBILITIES: NDR Platform EngineeringDesign, deploy, configure, and maintain Arista NDR and network visibility solutionsDevelop network detection use cases aligned with organizational security requirements and threat modelsOptimize network telemetry collection, traffic visibility, packet analysis, and behavioral analyticsEnsure high availability, scalability, and performance of NDR infrastructureDetection Engineering & Alert TuningCreate, test, and maintain detection rules, threat indicators, and behavioral analyticsDevelop alerting strategies that prioritize actionable incidents while minimizing alert fatigueContinuously tune alerts and detection logic based on SOC feedback, threat intelligence, and incident trendsAnalyze false-positive and false-negative events and implement improvementsEstablish severity classifications, escalation workflows, and operational runbooksSOC Integration & Operational SupportPartner with SOC analysts to improve incident detection, triage, and response effectivenessDevelop alert enrichment processes to provide analysts with actionable contextDefine KPIs and metrics related to alert quality, escalation rates, and detection effectivenessParticipate in threat hunting activities and post-incident reviewsAutomation & OrchestrationDesign and implement automated response workflows utilizing Arista APIs and automation frameworks.Automate alert enrichment, ticket creation, incident correlation, and response actions.Develop integrations between Arista platforms, SIEM solutions, and ITSM systems.Create automated containment and remediation workflows where appropriate.ServiceNow IntegrationIntegrate NDR-generated alerts with ServiceNow Incident Management and Security Operations workflowsBuild and maintain incident creation, assignment, escalation, and closure automationDevelop bidirectional integrations to update incidents based on security investigation outcomesCreate dashboards and report to track detection performance and response metricsContinuous ImprovementEvaluate emerging threats and adapt detection content accordinglyRecommend enhancements to network visibility, monitoring, and response processesMaintain technical documentation, architecture diagrams, and operational proceduresMentor junior engineers and SOC personnel on network threat detection best practices REQUIRED QUALIFICATIONS:Bachelor's degree in Computer Science, Information Security, Network Engineering, or equivalent experienceAt least 5+ years of experience in network security, cybersecurity operations, or detection engineeringAt least 3+ years of experience with Arista networking and security platformsStrong understanding of: TCP/IP, DNS, routing, switching, and network architecturesNetwork threat detection methodologiesSecurity operations and incident response processesSecurity monitoring, SIEM platforms, and alert lifecycle managementExperience designing and tuning security alerts in operational SOC environmentsExperience reducing false positives and improving detection fidelityExperience with REST APIs, automation scripting, and workflow orchestrationProficiency with Python, PowerShell, or similar automation languagesExperience integrating security platforms with ServiceNowStrong analytical, troubleshooting, and communication skills PREFERRED QUALIFICATIONS: Hands-on experience with: Arista NDR platformsArista CloudVisionArista DANZ Monitoring Fabric (DMF)Arista MSS or related security analytics technologiesExperience with: SIEM platforms (Microsoft Sentinel, Splunk, QRadar, Elastic)SOAR platforms and automated incident responseThreat intelligence integrationDetection engineering frameworksMITRE ATT&CK mappingFamiliarity with: ServiceNow Security Operations (SecOps)ServiceNow Incident ManagementITSM workflow automationPython-based API integrationsInfrastructure as Code and DevOps practicesRelevant certifications preferred: Arista certificationsCISSPGCIAGCIHCCNP SecurityMicrosoft Security certifications DESIRED TECHNICAL COMPETENCIES: Detection EngineeringAlert architecture and lifecycle managementThreat modelingBehavioral analytics tuningThreat huntingDetection validationAutomationAPI developmentPython scriptingWorkflow orchestrationEvent-driven automationAutomated response playbooksPlatform IntegrationArista ecosystem integrationServiceNow integration developmentSIEM connectivityTicketing automationSecurity data enrichment SUCCESS METRICS: The successful candidate will:Improve alert fidelity and reduce false-positive rates.Increase SOC efficiency through automation and alert enrichment.Accelerate mean time to detect (MTTD) and mean time to respond (MTTR).Develop scalable integrations between Arista tools, ServiceNow, and security platforms.Establish measurable improvements in network threat detection coverage and operational effectiveness.This role is ideal for an engineer who enjoys bridging networking, cybersecurity operations, and automation to build a highly effective network detection and response program. We are an equal opportunity employer, and we are an organization that values diversity. We welcome applications from all qualified candidates, including minorities and persons with disabilities. req26-00728