Network Detection and Response Engineer

About your role:

As a Cyber Network Engineer, Network Detection & Response (NDR), you will lead the engineering and continuous improvement of network threat detection capabilities across global infrastructure. You will work with cyber architecture, computer security incident response teams, cloud security, and platform engineering teams to deliver scalable network observability and response solutions. Your work will help strengthen detection coverage, improve response readiness, and protect digital assets from evolving network-based threats.

What you'll do:

• Engineer, deploy, and maintain network detection and response (NDR) platforms, including sensor placement, data ingestion, dashboard development, and alert tuning.
• Lead implementation and optimization of ExtraHop Reveal(x) or similar NDR platforms to improve network visibility, threat detection, and security analytics.
• Integrate NDR telemetry with security information and event management (SIEM) and security orchestration, automation, and response (SOAR) platforms to improve correlation and automated response workflows.
• Develop and enhance network-based detection use cases including behavioral analytics, lateral movement detection, encrypted traffic analysis, and threat hunting support.
• Partner with computer security incident response teams (CSIRT) to refine detection logic, incident response playbooks, and operational procedures based on NDR insights.
• Develop automation scripts using Python, PowerShell, Perl, or similar languages to streamline deployment, telemetry enrichment, and monitoring of NDR and network security tools.
• Conduct network surveys and planning activities to support sensor coverage, traffic visibility, and onboarding of new environments or acquired business units.
• Define, track, and report key performance indicators (KPIs) that measure the performance, compliance, and effectiveness of NDR controls and threat detection capabilities.
• Support internal audits, regulatory requests, risk management activities, and disaster recovery planning through clear documentation and analysis of network observability posture.
• Provide technical guidance and mentorship to engineering resources supporting NDR and broader network security initiatives.
• Responsibilities listed are not intended to be all-inclusive and may be modified as necessary.

Experience you'll need to have:

• 8+ years of experience in information security, cybersecurity engineering, or network security roles supporting enterprise or regulated environments.
• 8+ years of experience in large-scale corporate network environments, including network infrastructure protection and threat detection capabilities.
• 5+ years of experience with network detection and response platforms or network-based threat detection methodologies.
• 3+ years of experience with ExtraHop Reveal(x) or similar platforms such as Arista NDR, Darktrace, or Vectra AI.
• 5+ years of experience with network security technologies such as firewalls, next-generation firewalls (NGFW), intrusion detection systems (IDS), intrusion prevention systems (IPS), and proxy technologies.
• 3+ years of experience supporting cloud or hybrid infrastructure environments such as Amazon Web Services (AWS), Microsoft Azure, or similar platforms.
• Experience with Python, PowerShell, Perl, or similar scripting languages used for automation, enrichment, and operational support.
• Bachelors degree or higher in Cybersecurity, Information Systems, Computer Science, Engineering, or related field or equivalent combination of education, related experience and/or military experience.

Experience that would be great to have:

• Network or security certifications such as Cisco Certified Network Professional (CCNP), Certified Information Systems Security Professional (CISSP), Certified Ethical Hacker (CEH), or equivalent certification.
• Experience with Linux or Unix administration, Secure Sockets Layer (SSL) certificate management, and Domain Name System (DNS).
• Experience mentoring technical teams and supporting complex technical engagements across cybersecurity programs.
• Experience in financial services, payments, or other highly regulated environments.

How you'll work:

• This role is on-site Monday through Friday. Fiserv considers in-person collaboration to be an essential part of this role as in-person office experiences help you with your overall onboarding experience and leads to stronger productivity.