Professional Services Engineer

About this role

Be part of the team that defends the networks the world depends on

Corelight defends the world’s most sensitive networks—from global commerce to national defense—quietly, relentlessly, and with resolve. As cyber threats grow faster and smarter, we serve as the trusted force behind network resilience, putting elite defense within reach.

By transforming digital footprints from physical, virtual, and cloud networks into actionable insights, we empower defenders to illuminate blind spots and stay ahead of an evolving threat landscape. Built on open-source innovations and fueled by industry leading agentic AI technology, Corelight helps teams to detect advanced threats and close cases with unprecedented clarity and precision.

We are currently seeking a Staff Resident PSE to join our Federal Professional Services team, reporting to the manager of Professional Services. In this role, the main focus is to prepare and validate equipment configurations for new installations, develop content for anomaly and hunt detections, assess the overall health of the Corelight infrastructure at the client’s location. You’re the ideal candidate if you are a strategic thinker with a strong networking and security background, work well independently, and are results-driven.

Key Responsibilities:

• Help customers improve their cybersecurity posture, with a particular focus on process
optimization

• Help investigate incidents

• Educate on Zeek Log use, including as it relates to Corelight Suricata alerts

• Design and implement technical solutions with ecosystem partners (packet brokers,
asset managers, SOAR systems, etc.)

• Implement queries and dashboards in SIEMs - Splunk, Elastic, Humio, etc.

• Influence customers and Corelight teams and be seen as a technical expert

• Conduct network-related testing to ensure Corelight products operate correctly

• Perform validation testing of Corelight products

• Provide ongoing, informal, knowledge transfer

• Collaborate with product management on product features/integrations

• Work with back-end tools like Kafka and Logstash

• Documenting the process for importing of data (MISP, Intel, etc)

• Developing custom content for threat hunting use cases as defined by the customer

• Developing playbooks for SOC/IR workflow automation based on Corelight data

• Ad-hoc (as requested) written summary reports on equipment and security…