Senior Network Forensics & Packet Capture Engineer
Employer · Citi
Cybersecurity specialistNetwork engineerFlexibleFull-timeBudapest
Citi's Perimeter Reliability Engineering team is seeking a Senior Network Forensics & Packet Capture Engineer to architect, deploy, and operate high-performance full-packet capture infrastructure across Citi's global network perimeter. This is a senior engineering role at the intersection of network visibility, security forensics, and platform automation.
Tasks
- Design and own end-to-end full-packet capture infrastructure across global sites, encompassing TAP aggregation fabrics, out-of-band offload networks, high-throughput NVMe/ZFS storage, and OpenSearch indexing clusters.
- Deploy, tune, and scale Arkime at enterprise level, including capture daemon configuration, BPF filter hierarchies, OpenSearch Index Lifecycle Management, and Viewer customization tailored to SOC analyst workflows.
- Engineer hardware-accelerated packet capture solutions using SmartNICs, kernel-bypass frameworks including DPDK, PF_RING ZC, and AF_XDP, and TAP aggregation platforms to sustain high-throughput capture without packet loss.
- Build and maintain production-grade Python automation for PCAP archival pipelines, Arkime REST API integrations, OpenSearch lifecycle management, and event-driven packet extraction workflows.
- Operate and extend Zeek for deep protocol metadata extraction, develop custom Zeek scripts, and integrate output into SIEM and threat intelligence platforms.
- Lead forensic root cause analysis for complex network security incidents, applying Wireshark, tshark, tcpdump, and session logs to reconstruct attack timelines and session activity.
- Integrate PCAP platforms with AI and machine learning threat detection pipelines, including JA3/JA3S TLS fingerprinting and alert-to-packet correlation workflows, to accelerate detection and investigation.
- Develop Grafana dashboards and alerting pipelines using Prometheus and InfluxDB to provide real-time visibility into capture rates, packet drops, storage consumption, and cluster health.
Conditions & benefits
Cafeteria ProgramHome Office AllowanceFor colleagues working in hybrid work modelsPaid Parental Leave ProgramMaternity and paternity leavePrivate Medical Care ProgramOnsite medical rooms at our officesPension Plan ContributionTo voluntary pension fundGroup Life InsuranceEmployee Assistance ProgramLearning and development programsAccess to online course libraries and upskilling platforms, such as Udemy and DegreedFlexible work arrangementsHybrid working model with up to 2 days working at home per week
Requirements
- 7 or more years in infrastructure or network security engineering, including a minimum of 3 to 4 years in dedicated packet capture, network forensics, or network visibility roles.
- Expert-level Arkime deployment and operations, including capture daemon tuning, multi-site OpenSearch cluster architecture, and large-scale platform scaling.
- Hands-on packet capture infrastructure engineering covering TAP, SPAN, and ERSPAN design, aggregation fabric architecture, out-of-band network design, and storage tiering with NVMe and ZFS.
- Proficiency in Python, applied specifically to PCAP lifecycle automation, Arkime API scripting, OpenSearch query pipelines, and infrastructure tooling development.
- Expert-level protocol analysis using Wireshark, tshark, and tcpdump, including advanced filter construction and full session reconstruction.
- Linux performance tuning at the system level, including kernel parameter configuration, NUMA topology awareness, CPU pinning, and NIC queue optimization.
- Bachelor's degree in a relevant field or equivalent practical experience; a Master's degree is preferred.