Escalation Engineer

Do you want to help make the world safe from cyber attack?

At Corelight, we believe that the best approach to cybersecurity risk starts with the network. Attackers can evade endpoint detection, firewalls and many other technologies - but they can’t avoid leaving digital footprints on the networks they traverse. Built on open-source innovations from Zeek, Suricata and YARA and refined through years of real-world use, Corelight transforms network footprints from physical, virtual and cloud networks into actionable insights. Our customers use these insights to speed incident response and proactively hunt for threats.

As an Escalation Engineer, you are the critical bridge between our customers' most complex technical challenges and our innovative engineering solutions. You aren't just resolving support cases; you are ensuring that the world's most sensitive organizations have the visibility they need to disrupt attacks. By mastering everything from Linux internals to cloud networking, you serve as a technical champion who ensures Corelight's "evidence" remains the gold standard for defenders worldwide.

Specific Responsibilities:

• Drive Technical Resolution: Serve as the primary point of contact for complex customer escalations and Proof of Concepts (POCs), ensuring successful outcomes for mission-critical issues.
• Deep-Dive Troubleshooting: Conduct advanced root cause analysis (RCA) involving Linux internals, hardware performance, and intricate network topologies.
• Manage High-Stakes Cases: Orchestrate and drive multiple high-priority cases simultaneously, maintaining focus and urgency under pressure.
• Internal Advocacy: Act as a liaison between the field and HQ, translating customer requirements into structured, actionable feedback for Engineering and Product Management.
• Deliver Excellence: Provide regular, transparent status updates to stakeholders and customers, adhering strictly to defined SLAs while offering best-practice guidance for Corelight solutions.
• Network Optimization: Identify underlying issues and recommend architectural or configuration changes to customer networks to improve product reliability and performance.

Knowledge/Skills/Abilities needed to be successful:

• A Customer-First Mindset: A relentless drive to advocate for the customer and see problems through to a successful conclusion.
• Clear Communication: The ability to articulate complex technical concepts—both verbally and in writing—to audiences ranging from SOC analysts to executive leadership.
• Collaborative Resourcefulness: A proven ability to work cross-functionally and thrive in a fluid, high-growth environment.
• Operational Readiness: Flexibility to participate in a rotational on-call schedule (including nights/weekends) to support global, high-priority customer needs.

Qualifications/Requirements:

• Experience: 5+ years in a hands-on technical role focusing on post-sales support (troubleshooting, sysadmin, or network security).
• Technical Depth: Strong proficiency in UNIX/Linux administration, including performance monitoring, kernel-level tracing, and debugging system calls.
• Networking Expertise: Deep understanding of TCP/IP fundamentals, routing/switching, and common protocols (VLANs, NAT, VPNs).
• Cloud & Virtualization: Proven experience troubleshooting cloud networking (AWS, Azure, GCP) and virtualization platforms (ESXi, Hyper-V).
• Education: BS/BA or equivalent in a relevant field (CS, EE, MIS).
• Preferred Skills: Familiarity with Zeek scripting, Python, packet capture utilities (Wireshark/tcpdump), and expert-level protocol knowledge (SMB, HTTP, TLS/SSL). Security certifications (CISSP, GIAC) are a plus.

Fueled by investments from top-tier venture capital organizations such as Crowdstrike, Accel and Insight, Corelight is the fastest growing network detection and response platform in the industry. Our customers trust us to protect mission-critical assets in leading enterprises, government, and research institutions worldwide. We are leading the way with AI-assisted workflows, machine learning models, cloud security and SaaS-based solutions to arm defenders with the tools and knowledge they need to disrupt cyber attacks. Our team of passionate innovators are dedicated to solving some of the toughest challenges in cybersecurity, while fostering a collaborative, inclusive, and growth-oriented culture. Corelight is committed to a geographically distributed yet connected employee base with employees working from home and office locations around the world. At Corelight, we take pride in the diversity of our backgrounds and perspectives, and we are committed to fostering an inclusive environment that strengthens our company. By embracing a wide range of experiences, backgrounds, neurodiversity, talents, and approaches to problem-solving, we aim to create a workplace where everyone can thrive and contribute their best.

We are looking forward to meeting you. Check us out at www.corelight.com

Do you want to help make the world safe from cyber attacks?

At Corelight, we believe that the best approach to cybersecurity risk starts with the network. Attackers can evade endpoint detection, firewalls and many other technologies - but they can’t avoid leaving digital footprints on the networks they traverse. Built on open-source innovations from Zeek, Suricata and YARA and refined through years of real-world use, Corelight transforms network footprints from physical, virtual and cloud networks into actionable insights. Our customers use these insights to speed incident response and proactively hunt for threats.

As a Technical Account Manager, you are the primary bridge between Corelight’s cutting-edge technology and our most strategic global customers. You don’t just resolve technical hurdles; you serve as a high-level consultant, empowering organizations to harness the full power of Zeek and Suricata to defend their mission-critical infrastructure. By translating complex network data into tangible security outcomes and advocating for customer needs directly with our Engineering and Product teams, you play a pivotal role in ensuring our partners stay ahead of evolving threats while directly influencing the future of our platform.

Specific Responsibilities:

• Strategic Partnership: Establish and cultivate deep technical and executive relationships within strategic accounts to ensure long-term product alignment and satisfaction.
• Value Realization: Partner with Sales teams to provide ongoing confirmation of the value Corelight products deliver, ensuring customers achieve their specific security objectives.
• Custom Implementation: Work hands-on with customers to operationalize new features, utilize existing Zeek packages, and develop custom scripts to solve unique security challenges.
• Cross-Functional Advocacy: Serve as the "Voice of the Customer" by coordinating with Engineering and Product Management to prioritize feature requests and communicate real-world impact.
• Lifecycle Management: Guide customers through critical post-sales milestones, driving the successful adoption and operationalization of Corelight’s suite of services.
• Technical Troubleshooting: Perform expert-level configuration, hands-on troubleshooting, and technical demonstrations to resolve complex environment issues.
• Operational Excellence: Maintain rigorous documentation of customer health and communication strategies within the ClientSuccess platform.

Being successful on this team requires:

• Strategic Communication: The ability to translate granular technical details into clear, high-level business value for diverse audiences, from SOC analysts to C-suite executives.
• Technical Agility: A "lead-from-the-front" mentality that balances high-level account strategy with the ability to dive deep into packet captures and scripts.
• Proactive Problem Solving: A dedication to anticipating customer roadblocks before they occur and guiding them toward best-practice security architectures.
• Collaborative Influence: The skill to navigate internal teams (Sales, Engineering, Product) to maintain customer momentum and drive product improvements.
• Adaptability & Availability: A commitment to supporting strategic customers during critical windows 

Qualifications/Requirements:

• Experience: 7+ years in a hands-on technical role such as security engineering, system administration, or network operations.
• Domain Expertise: Subject matter expertise in network security, incident response, and threat hunting, including familiarity with Zeek, Suricata, and adjacent markets (EDR, SIEM, Splunk, ELK, etc.).
• Networking Depth: Advanced understanding of network protocols (SMB, HTTP, DNS, TLS/SSL, X.509) and expert-level experience with packet analysis tools (Wireshark, tcpdump, PCAP).
• Education: BS/BA or equivalent in a relevant field (Computer Science, Electrical Engineering, MIS).
• Communication: Exceptional business writing and presentation skills; must be comfortable presenting to technical and executive stakeholders.
• Mobility: Willingness and ability to travel, including international assignments.
• Preferred: Professional or expert-level security certifications (CISSP, CISM, GIAC, etc.) are highly desirable.

Fueled by investments from top-tier venture capital organizations such as Crowdstrike, Accel and Insight, Corelight is the fastest growing network detection and response platform in the industry. Our customers trust us to protect mission-critical assets in leading enterprises, government, and research institutions worldwide. We are leading the way with AI-assisted workflows, machine learning models, cloud security and SaaS-based solutions to arm defenders with the tools and knowledge they need to disrupt cyber attacks. Our team of passionate innovators are dedicated to solving some of the toughest challenges in cybersecurity, while fostering a collaborative, inclusive, and growth-oriented culture. Corelight is committed to a geographically distributed yet connected employee base with employees working from home and office locations around the world. At Corelight, we take pride in the diversity of our backgrounds and perspectives, and we are committed to fostering an inclusive environment that strengthens our company. By embracing a wide range of experiences, backgrounds, neurodiversity, talents, and approaches to problem-solving, we aim to create a workplace where everyone can thrive and contribute their best.

We are looking forward to meeting you. Check us out at www.corelight.com

By making evidence the heart of security, we help customers stay ahead of ever-changing cyber-attacks. 

Corelight is the cybersecurity company that transforms network and cloud activity into evidence.  Evidence that elite defenders use to proactively hunt for threats, accelerate response to cyber incidents, gain complete network visibility and create powerful analytics using machine-learning and behavioral analysis tools.  Easily deployed, and available in traditional and SaaS-based formats, Corelight is the fastest-growing Network Detection and Response (NDR) platform in the industry.  And we are the only NDR platform that leverages the power of Open Source projects in addition to our own technology to deliver Intrusion Detection (IDS), Network Security Monitoring (NSM), and Smart PCAP solutions.  We sell to some of the most sensitive, mission critical large enterprises and government agencies in the world.

We are seeking a very talented, resourceful, and collaborative person to help us grow our Professional Services team.  This person will be assisting customers to deploy and use our cybersecurity products. This is a great opportunity for someone who is passionate and committed and wants to be able to look back a year from now and say with pride, “I helped build that from the ground up.”  The role covers quite varied ground depending on the engagement.

Opportunity:

• Help customers improve their cybersecurity posture, with a particular focus on process optimization
• Help investigate incidents
• Educate on Zeek Log use, including as it relates to Corelight Suricata alerts
• Design and implement technical solutions with ecosystem partners (packet brokers, asset managers, SOAR systems, etc.)
• Implement queries and dashboards in SIEMs - Splunk, Elastic, Humio, etc.
• Influence customers and Corelight teams and be seen as a technical expert
• Collaborate with product management on product features/integrations
• Work with back-end tools like Kafka and Logstash

Qualifications:

• 5+ years experience in a security professional services role
• Bachelor’s degree in a technical field (or equivalent experience)
• Strong background in cybersecurity
• Solid verbal and written communication skills
• Enjoy designing novel solutions
• Understand how to scope and describe a services engagement
• Robust problem-solving skills, the ability to learn from doing, personal accountability, and a positive and professional attitude
• Zeek log experience and log analysis skills are required
• Network administration, firewall configuration, and strong knowledge of TCP/IP
• Windows/MacOS/Linux/Unix administration experience
• Scripting in (some of) Zeek, Bash, Python, Perl, Powershell, etc.
• SIEM experience (Splunk required, others a bonus)
• Travel up to 50% post-COVID; some travel now, depending on customer comfort levels
• Prior startup experience preferred 

Fueled by investments from top-tier venture capital organizations such as Crowdstrike, Accel and Insight, Corelight is the fastest growing network detection and response platform in the industry. Our customers trust us to protect mission-critical assets in leading enterprises, government, and research institutions worldwide. We are leading the way with AI-assisted workflows, machine learning models, cloud security and SaaS-based solutions to arm defenders with the tools and knowledge they need to disrupt cyber attacks. Our team of passionate innovators are dedicated to solving some of the toughest challenges in cybersecurity, while fostering a collaborative, inclusive, and growth-oriented culture.

Corelight is committed to a geographically distributed yet connected employee base with employees working from home and office locations around the world.  At Corelight, we take pride in the diversity of our backgrounds and perspectives, and we are committed to fostering an inclusive environment that strengthens our company. 

We look forward to meeting you. Check us out at www.corelight.com

Do you want to help make the world safe from cyber attack?

At Corelight, we believe that the best approach to cybersecurity risk starts with the network. Attackers can evade endpoint detection, firewalls and many other technologies - but they can’t avoid leaving digital footprints on the networks they traverse. Built on open-source innovations from Zeek, Suricata and YARA and refined through years of real-world use, Corelight transforms network footprints from physical, virtual and cloud networks into actionable insights. Our customers use these insights to speed incident response and proactively hunt for threats.

Job Summary:
We are currently seeking a Staff Resident PSE to join our Federal Professional Services team, reporting to the manager of Professional Services. In this role, the main focus is to prepare and validate equipment configurations for new installations, develop content for anomaly and hunt detections, assess the overall health of the Corelight infrastructure at the client’s location. You’re the ideal candidate if you are a strategic thinker with a strong networking and security background, work well independently, and are results-driven.

Key Responsibilities:

• Help customers improve their cybersecurity posture, with a particular focus on process
  optimization
• Help investigate incidents
• Educate on Zeek Log use, including as it relates to Corelight Suricata alerts
• Design and implement technical solutions with ecosystem partners (packet brokers,
  asset managers, SOAR systems, etc.)
• Implement queries and dashboards in SIEMs - Splunk, Elastic, Humio, etc.
• Influence customers and Corelight teams and be seen as a technical expert
• Conduct network-related testing to ensure Corelight products operate correctly
• Perform validation testing of Corelight products
• Provide ongoing, informal, knowledge transfer
• Collaborate with product management on product features/integrations
• Work with back-end tools like Kafka and Logstash
• Documenting the process for importing of data (MISP, Intel, etc)
• Developing custom content for threat hunting use cases as defined by the customer
• Developing playbooks for SOC/IR workflow automation based on Corelight data
• Ad-hoc (as requested) written summary reports on equipment and security problems
• Technical input to major service outage root cause analysis and corrective action reports
• Leading project status meetings and wrap-up/post-mortem meetings
• Some on-site work required

Minimum Qualifications:

• US Citizen
• 5+ years of experience in cybersecurity (Prior startup experience preferred)
• Extensive experience with a SOC environment
• Zeek/Corelight experience is a plus
• Security and/or Networking related certification(s)
• Demonstrated expertise in Windows/MacOS/Linux/Unix operating systems, IDS/IPS,
• Network administration, firewall configuration, and strong knowledge of TCP/IP
• SIEM experience (Splunk required, others a bonus)
• Scripting in (some of) Zeek, Bash, Python, Perl, Powershell, etc.
• Strong briefing skills; experience interacting with SES/general officer-level management

Fueled by investments from top-tier venture capital organizations such as Crowdstrike, Accel and Insight, Corelight is the fastest growing network detection and response platform in the industry. Our customers trust us to protect mission-critical assets in leading enterprises, government, and research institutions worldwide. We are leading the way with AI-assisted workflows, machine learning models, cloud security and SaaS-based solutions to arm defenders with the tools and knowledge they need to disrupt cyber attacks. Our team of passionate innovators are dedicated to solving some of the toughest challenges in cybersecurity, while fostering a collaborative, inclusive, and growth-oriented culture.

Corelight is committed to a geographically distributed yet connected employee base with employees working from home and office locations around the world.  At Corelight, we take pride in the diversity of our backgrounds and perspectives, and we are committed to fostering an inclusive environment that strengthens our company. 

We look forward to meeting you. Check us out at www.corelight.com