Senior Network Forensics & Packet Capture Engineer

About the role

Citi's Perimeter Reliability Engineering team in Budapest is looking for a Senior Network Forensics & Packet Capture Engineer to architect, deploy and operate high-performance full-packet capture infrastructure across Citi's global network perimeter. The role sits at the intersection of network visibility, security forensics and platform automation, supporting enterprise threat detection, SOC investigations and forensic response.

Key responsibilities

• Design and own end-to-end full-packet capture infrastructure across global sites, including TAP aggregation fabrics, out-of-band offload networks, NVMe/ZFS storage and OpenSearch indexing clusters.
• Deploy, tune and scale Arkime at enterprise level, including capture daemon configuration, BPF filters, OpenSearch index lifecycle management and Viewer customization for SOC analysts.
• Build hardware-accelerated capture solutions using SmartNICs, kernel-bypass frameworks (DPDK, PF_RING ZC, AF_XDP) and TAP aggregation.
• Build and maintain Python automation for PCAP archival pipelines, Arkime REST API integrations and event-driven packet extraction.
• Operate and extend Zeek, write custom scripts and integrate its output into SIEM and threat intelligence platforms.
• Lead forensic root cause analysis for complex incidents using Wireshark, tshark, tcpdump and session logs.
• Integrate PCAP platforms with AI/ML threat detection, including JA3/JA3S TLS fingerprinting and alert-to-packet correlation.
• Develop Grafana dashboards and alerting pipelines with Prometheus and InfluxDB for capture rates, packet drops, storage consumption and cluster health.

Required profile

• 7+ years in infrastructure or network security engineering, with 3-4 years in packet capture, network forensics or network visibility.
• Bachelor's degree in a relevant field or equivalent practical experience; a Master's preferred.

Required skills

• Expert Arkime deployment and operations, multi-site OpenSearch clusters and large-scale scaling.
• TAP, SPAN, ERSPAN design, aggregation fabrics, out-of-band networks and NVMe/ZFS storage.
• Python for PCAP automation, Arkime API scripting and OpenSearch query pipelines.
• Wireshark, tshark and tcpdump, Linux performance tuning (kernel parameters, NUMA, CPU pinning, NIC queues).
• Nice to have: DPDK, PF_RING ZC, AF_XDP, Zeek scripting, Ansible, ML-based anomaly detection, open-source contributions to Arkime, Zeek or Suricata.

What we offer

• Hybrid work model (up to 2 days at home per week) in a business casual workplace.
• Cafeteria program, home office allowance, paid parental leave and private medical care.
• Pension plan contribution, group life insurance and employee assistance program.
• Learning programs via Udemy and Degreed, flexible work arrangements and career progression opportunities.