Threat Detection Engineer – Tetragon

About the role

The Tetragon Threat Detection Engineer will design, implement, and maintain runtime security policies for Cilium Tetragon, a low‑overhead, eBPF‑based security solution for Kubernetes environments. You will work closely with product engineers and customers to ensure visibility into suspicious activity and protection against emerging threats.

Key responsibilities

• Develop and maintain Tetragon runtime security policies that detect and mitigate threats.
• Design frameworks that enable customers to consume policies easily and understand their security posture.
• Monitor CVE disclosures and threat intelligence to keep policies up‑to‑date.
• Collaborate with Isovalent and Cisco software engineers to enhance policy capabilities.
• Support solution architects and customers during policy deployment in production environments.
• Publish technical content and present talks based on your work.

Required profile

• 3+ years of experience in threat or vulnerability research.
• 3+ years of experience building security detections at scale across diverse environments.
• 3+ years of experience with Linux system security (e.g., capabilities, LSMs).
• Strong written and verbal communication skills.

Required skills

• eBPF and its security applications.
• Linux system security mechanisms (capabilities, LSMs).
• Containers and Kubernetes.
• Linux cgroups and namespaces.