Principal Engineer Network Forensics & Incident Response

Verizon • Southlake, TX

2d • Hybrid

About The Position

Verizon’s N&T Network Security team is seeking a Principal Engineer to join the Security Defense organization. The Defense teams own the security lifecycle and effectiveness across Core, Edge, and Access networks and the systems and network functions within N&T. This role serves as the primary technical lead for network digital forensics and incident response (DFIR) across the Network Security Defense portfolio, operating with autonomy and without guidance. The engineer will lead response efforts for major enterprise-wide security events, architect forensic capabilities, define DFIR standards, and work across the Defense organization to mature its security posture.

The position leads complex forensic collection and response programs, serves as technical incident commander during high-consequence events, analyzes network telemetry and forensic artifacts, develops threat detections, and builds automated forensic collection and response tooling. It also includes developing incident playbooks and producing investigation reports covering timelines, root cause, evidence, impact, and remediation.

This hybrid role has a defined work location at a Verizon hub in the United States. Employees work from home and in the office at least three days per week, with the schedule and location set by the manager. The role is scheduled for 40 hours per week. The annual salary range is $120,500 to $231,000, depending on location and job-related skills and experience; the position is incentive-based and has potential for additional earnings.

Requirements

• Bachelor’s degree or four or more years of relevant work experience.
• Six or more years of relevant experience in digital forensics, network security engineering, or incident response, demonstrated through work and/or military experience or specialized training.
• Proven ability to operate autonomously, drive complex technical initiatives, and command major incidents without supervision.
• Deep experience with SIEM and data analysis platforms such as Splunk or ELK.
• Strong proficiency with forensic acquisition and analysis tools such as EnCase, FTK, Volatility, X-Ways, SANS SIFT, and KAPE.
• Hands-on experience authoring and operationalizing YARA or YARA-L rules for binary inspection, memory dumps, and file artifact extraction.
• Expert knowledge of TCP/IP, BGP, OSPF, DNS, TLS, HTTP/S, and network telemetry formats such as NetFlow, IPFIX, and syslog.
• Proficiency in Python, PowerShell, or Bash scripting and automation for forensic artifact collection and processing.

Nice To Haves

• Industry-recognized DFIR certifications such as GNFA, GCFA, GCIH, or CCE.
• Experience performing forensics on 4G/5G wireless network functions, carrier-grade IP networks, or virtualization platforms such as Kubernetes, OpenStack, or KVM.
• Knowledge of the MITRE ATT&CK framework and integration of enterprise threat intelligence into forensic workflows.
• Effective written, interpersonal, and verbal communication skills, including the ability to summarize complex findings for technical and non-technical audiences.
• Ability to work with diverse stakeholders, including technical engineering teams, business owners, and executives.
• Strong leadership and mentoring abilities, including experience guiding and developing teams.
• Proven ability to manage and deliver results under high-pressure security incident scenarios.

Responsibilities

• Lead complex, enterprise-wide forensic collection strategies and incident response programs across Core, Edge, and virtualized network infrastructure.
• Serve as the technical incident commander during major security events, coordinating cross-functional response, executive communications, and containment strategy.
• Analyze packet captures, NetFlow/IPFIX, firewall logs, and router and switch artifacts to investigate lateral movement and data exfiltration.
• Architect and maintain YARA rules and lead forensic analysis across memory, endpoints, custom appliances, and network equipment.
• Investigate advanced persistent threat tactics, extract indicators of compromise, and turn forensic findings into actionable detections.
• Architect and scale automated, cloud-native forensic collection pipelines, triage engines, and orchestration tools.
• Develop and refine DFIR playbooks and runbooks for high-impact incidents, including state-sponsored intrusions, ransomware, supply chain compromises, and DDoS events.
• Produce forensic investigation reports detailing attack timelines, root cause, evidence analysis, impact assessment, and technical remediation recommendations.
• Define DFIR standards and partner across the Defense organization to continuously mature the security posture.

Benefits

• Medical, dental, and vision coverage
• Short- and long-term disability insurance
• Basic and supplemental life insurance
• AD&D insurance
• Identity theft protection
• Pet insurance
• Group home and auto insurance
• Matched 401(k) savings plan
• Up to 8 company-paid holidays per year
• Up to 6 personal days per year
• Paid parental leave
• Adoption assistance
• Tuition assistance
• Potential premium pay, including overtime, shift differential, holiday pay, and allowances, depending on the role
• Up to 15 days of vacation per year for newly hired employees, increasing with additional service
• Other incentives and an award-winning total rewards package

What This Job Offers

• Job Type: Full-time
• Career Level: Principal