Sr Security Researcher; Decoder

Job Summary

You will be part of the team that develops the Intrusion Prevention System to power the Palo Alto Networks’s next generation firewall. The Decoder team is responsible for decoding network protocols and inspecting application traffic on enterprise customers’ networks, providing common service to support a variety of network security services.

As a member of the Decoder team, you have the opportunity to work on our security engine, and collaborate with different intelligent teams on various advanced cybersecurity products.

• Research networking protocols and related application networking behavior.
• Research file types and file properties.
• Research and provide defense mechanisms against popular protocol/firewall evasions.
• Develop protocol and file decoders, and integrate the detection solutions with Palo Alto Networks products.
• Build common services to support various network security services.
• Develop internal tools to monitor and support the cyber security products.
• Cross-team collaboration, discover and integrate advanced cybersecurity features to inline product solutions.

• Strong programming and debugging skills, experience coding in Go required and C/C++ experience preferred.
• Strong understanding of Go concurrency, memory optimization, and scalable system design.
• Excellent understanding of L4-7 networking protocols such as HTTP, TLS, SMTP, FTP, Websocket, GRPC, TCP/IP, etc.
• Experience with packet processing, stream reassembly, protocol parsing, and traffic analysis systems.
• Experience in analyzing network traffic using tools like Wireshark, Fiddler, tcpdump etc.
• Familiar with Linux/Unix development environment.
• Team player, and good communication skills to work with cross-functional groups.
• BS/MS in Computer Science or Electrical Engineering or equivalent Military experience.
• 3+ years industry experience

• Knowledge and experience of next generation firewall and cyber security services.
• Understanding of protocol evasion techniques, fragmentation, and traffic obfuscation.
• Experience with Suricata, Zeek, eBPF, DPDK, or similar technologies.
• Experience with pattern matching engines, rule-based detection systems, or DFA/NFA concepts.
• Familiarity with performance profiling tools such as pprof, perf, or valgrind.
• Experience applying AI techniques to traffic classification, protocol identification, or anomaly detection is a big plus.

The compensation offered for this position will depend on qualifications, experience, and work location. For candidates who receive an offer at the posted level, the starting base salary (for non-sales roles) or base salary + commission target (for sales/com-missioned roles) is expected to be the annual range listed below. The offered compensation may also include restricted stock units and a bonus.

A description of our employee benefits may be found here.

$ - $/yr

We’re trailblazers that dream big, take risks, and challenge cybersecurity’s status quo. It’s simple: we can’t accomplish our mission without diverse teams innovating, together.

We are committed to providing reasonable accommodations for all qualified individuals with a disability. If you require assistance or accommodation due to a disability or special need, please contact us at accomm

Palo Alto Networks is an equal opportunity employer. We celebrate diversity in our workplace, and all qualified applicants will receive consideration for employment without regard to age, ancestry, color, family or medical care leave, gender identity or expression, genetic information, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran status, race, religion, sex (including pregnancy), sexual orientation, or other legally protected characteristics.

All your information will be kept confidential according to EEO guidelines.

Is role eligible for Immigration Sponsorship? No. Please note that we will not sponsor applicants for work visas for this position.