Senior Network Forensics & Packet Capture Engineer
Core
Architect, deploy, and operate high-performance full-packet capture infrastructure across Citi's global network perimeter to power enterprise threat detection, SOC investigations, and forensic response.
Role type
Senior IC network forensics and packet capture engineer
Builds
Global full-packet capture infrastructure (TAP aggregation, out-of-band offload, NVMe/ZFS storage, OpenSearch clusters) and automation pipelines
Domain
Financial services network security and infrastructure
Required skills
Arkime deployment and operations, Python for PCAP automation, Linux performance tuning, protocol analysis (Wireshark, tshark, tcpdump), TAP/SPAN/ERSPAN design, OpenSearch cluster architecture, SmartNIC/kernel-bypass technologies (DPDK, PF_RING ZC, AF_XDP)
Preferred skills
Zeek deployment and custom scripting, Ansible for IaC, machine learning-based network anomaly detection, open-source contributions to packet capture projects
Technologies
Arkime, OpenSearch, Python, Wireshark, tshark, tcpdump, Zeek, DPDK, PF_RING ZC, AF_XDP, SmartNICs, NVMe, ZFS, Grafana, Prometheus, InfluxDB, Ansible
Responsibilities
Design end-to-end full-packet capture infrastructure; Deploy and tune Arkime at enterprise scale; Engineer hardware-accelerated capture solutions using SmartNICs and kernel-bypass frameworks; Build Python automation for PCAP archival and event-driven extraction; Operate and extend Zeek for protocol metadata extraction; Lead forensic root cause analysis for network security incidents; Integrate PCAP platforms with AI/ML threat detection pipelines; Develop Grafana dashboards for real-time visibility
Seniority
Senior, hands-on IC
