דרושים » תוכנה » Senior Security Researcher - Identity - Security Automation (Cortex)

Are you passionate about taking automation to the next level? Do you live and breathe the cyber security world? Do you want to take part in an innovative and disruptive team that will have an impact on the lives of many customers?
As a Cloud Cybersecurity Researcher, you will design and implement remediation strategies for cloud runtime and posture issues, ensuring responses are as autonomous, effective, and safe as possible. You will collaborate with leading security experts, leverage cutting-edge technologies, and contribute to the vision of an Autonomous SOC.
Your Impact
Develop robust, testable, and safe remediation plans for cloud runtime and posture issues (CSPM, DSPM, CIEM, CNAPP, IAM, etc.)
Conduct in-depth research to identify attacker TTPs and cloud misconfiguration risks, and translate findings into automated response playbooks
Apply data analysis, programming, and modeling techniques to evaluate and optimize remediation approaches
Collaborate within a diverse research group to continuously improve automation processes and methodologies
Stay ahead of evolving threats, including cloud-native attack vectors and advanced adversary tradecraft.

Are you excited about leading a team of researchers who are redefining how cloud security is automated? Do you want to shape the future of an Autonomous SOC by building the next generation of remediation and response content?
As the Cloud Cybersecurity Research Manager, you will lead a team of talented researchers creating autonomous remediation plans for cloud runtime and posture issues. You will drive innovation, mentor researchers, and ensure our automation content is precise, safe, and impactful. This role combines hands-on technical knowledge with strategic leadership, empowering your team to deliver solutions that protect customers at scale.
Your Impact
Lead and mentor a team of cloud security researchers, fostering technical excellence, innovation, and collaboration
Define research priorities and guide the design of robust, testable, and autonomous remediation plans for cloud runtime and posture issues (CSPM, DSPM, CIEM, CNAPP, IAM, etc.)
Ensure high-quality delivery of SOAR playbooks and automation content aligned with customer needs and company vision
Collaborate with product, engineering, and threat research teams to maximize the impact of remediation content
Establish processes, KPIs, and best practices to continuously improve research output, playbook quality, and operational efficiency
Stay up to date with attacker TTPs, cloud-native threats, and emerging technologies to guide team direction.

Are you passionate about innovation in cloud security and want to redefine how Security Operations Centers (SOCs) leverage both agent and agentless technologies for detection and response? Join our cutting-edge Security Research team and lead the development of next-generation cloud detection and response solutions. In this role, you will define detection use cases, analyze threat data, and create advanced security content to protect against evolving threats in cloud environments. Be part of an exceptional team of researchers and engineers dedicated to safeguarding our customers. This is your opportunity to dive into pioneering technologies that integrate cloud security with innovative detection methodologies in a world-leading cybersecurity company.
Your Impact
Conduct ongoing research to identify and develop new detection techniques for both agent-based and agentless cloud technologies
Stay ahead of Advanced Threats, attacker methodologies, and Tactics, Techniques, and Procedures (TTPs) to ensure our solutions remain proactive and effective against emerging threats
Simulate real-world attack scenarios in lab settings, performing in-depth analysis of adversarial behaviors and their implications for cloud security
Foster a collaborative atmosphere within an experienced, diverse, and supportive research team, driving forward new and innovative ideas in cloud detection and response.

We are looking for a Senior Security Researcher to join our Identity Threat Detection and Response team.
In this role, you will research the evolving threat landscape and develop advanced detections to protect SAAS, Cloud, on-premises, and hybrid identities. You will focus on identifying and mitigating identity-related threats across networks, endpoints, and cloud environments, using statistical classification methods to build effective detection models and protecting customers at scale. Additionally, you will collaborate with cross-functional teams, validate detection concepts on real-world data, and continuously enhance detection capabilities to stay ahead of emerging threats.
Your Impact
Research innovative methods for detecting targeted attackers operating in endpoints, networks, cloud and SAAS environments
Simulate real-world attacks in lab environments and conduct a deep analysis of the behavior
Develop and refine statistics-based classification algorithms and techniques to create and improve detection models
Research specific scenarios to enhance our model's capabilities
Collaborate within a diverse research group, improving our research processes and leading us to be a better team creating a better product
Stay informed on the latest APTs, attacker methodologies, and TTPs to ensure our models stay ahead of emerging threats.

Required Sr. Threat Detection Engineer
About the Team:
You'll be joining our Cloud Content Research team, a team focused on stopping real-world adversaries targeting cloud infrastructure. Our unique position within allows us to work closely with our Threat Intelligence, OverWatch, and Incident Response teams, translating front-line observations of adversary tactics into effective detection capabilities. We combine deep cloud security expertise with innovative detection engineering to identify and stop sophisticated cloud threats. Our team creates advanced detection content and drives innovation in cloud security through close collaboration with Product and Engineering teams, who develop new detection capabilities based on our insights and requirements. We focus on both strategic research into emerging cloud attack techniques and rapid response to evolving adversary tactics observed in the wild.
About the Role:
As a Senior Cloud Detection Engineer, you'll be at the forefront of protecting organizations against sophisticated cloud threats, working with some of the industry's most advanced security technologies and enterprise-scale cloud environments. You'll have the unique opportunity to translate real-world adversary intelligence into innovative detection capabilities that protect many of the world's leading organizations across every major industry.
What You'll Do:
Research and develop detection content for cloud-native attacks, including identity-based threats, data exfiltration, privilege escalation, cloud-native tactics
Create correlation logic and between runtime events and control plane activities
Design and implement detection logic across multi-cloud and hybrid environments
Collaborate with Threat Intelligence, OverWatch, and Incident Response teams to develop detections based on real adversary activities
Partner with Product and Engineering teams to enhance detection capabilities.

We're looking for a Threat Detection Researcher to join the Threat Research team and spread the power of our company. In this role, you will further develop the Cloud-native Threat Detection domain.
WHAT YOULL DO
Design behavioral baselines for complex cloud environments using diverse signals, and develop high-fidelity detections based on those baselines.
Expand our company's detection engine with novel and high-impact telemetry sources, pushing the boundaries of what can be detected in modern cloud environments.
Conduct deep technical research into complex cloud services to uncover novel attack vectors.
Investigate real-world attacks across cloud environments, identity providers (IDPs), and infrastructure-as-a-service (IaaS) platforms.
Hunt and analyze emerging threats and active campaigns targeting cloud ecosystems.

If you are an innovator at heart and passionate about redefining how organizations secure modern environments end-to-end, we're looking for you.
As a Manager of the Core Cloud Posture team, you will lead a new, high-impact team of security researchers. You'll innovate and build on top of our market-leading posture portfolio and be responsible for the "what's next." Your mission is to innovate on top of this foundation, build the intelligent "connective tissue" that provides unparalleled context, and architect the next-generation features that will keep us ahead of the market.
Your Impact
Lead, and grow a team of talented security researchers focused on enhancing the cloud security posture of our customers.
Act as a technical mentor and force multiplier for junior security researchers. You will actively share your deep industry experience, guide their research methodologies, and foster a learning environment that accelerates their professional development from talented juniors into autonomous experts.
Champion the continuous evolution of our security logic. You will ensure our posture coverage keeps pace with the rapidly changing cloud landscape, systematically addressing gaps and refining our policies to address evolving threats.
Leverage our advanced cross-product engines to synthesize isolated findings into a cohesive, prioritized story of risk for the customer.
Stay ahead of the evolving cloud threat landscape, translating the latest research on cloud-native based attacks into resilient posture policies that effectively minimize the attack surface.
Foster collaboration across engineering, product management, and go-to-market teams to deliver impactful security solutions.

Were hiring our first Security Researcher to join our newly formed Security Research function- a critical role for someone passionate about advancing real-world SOC operations with deep cybersecurity expertise.
We are building a world-class Security Research team that will power our advanced product with deep, actionable cybersecurity expertise. This team will serve as the Subject Matter Experts (SMEs) behind our triage and Incident Response platform, defining logic, contributing threat intelligence, building use-case coverage, and continuously optimizing detection and investigation workflows.
Youll collaborate closely with Product, Engineering, and Customer Success to ensure our Auto-Triage engine reflects the latest adversarial techniques and real-world SOC operations.

Responsibilities:
Serve as a domain expert in SOC workflows, alert triage, and incident response.
Design and maintain triage logic, playbook blueprints, AI Agents and more for responding to security events.
Develop and maintain alert enrichment, correlation, and classification rules across multiple data sources (EDR, SIEM, Identity, etc.).
Collaborate with product teams to define use cases, threat coverage, and analyst workflows.
Analyze real-world alerts, telemetry, and incident data to enhance product accuracy, reduce false positives and improve incident handling.
Evaluate and curate threat intelligence feeds and sources to support automated decision-making.
Conduct post-incident reviews to extract lessons and update triage logic accordingly.
Stay current with emerging threats, attacker TTPs, MITRE ATT&CK, and other frameworks.
Assist with quality assurance, testing, and validation of triage logic before deployment.

Were hiring our first Product Security Researcher (SOC & Incident Response) to join our newly formed Security Research function- a critical role for someone passionate about advancing real-world SOC operations with deep cybersecurity expertise.
We are building a world-class Security Research team that will power our advanced product with deep, actionable cybersecurity expertise. This team will serve as the Subject Matter Experts (SMEs) behind our triage and Incident Response platform, defining logic, contributing threat intelligence, building use-case coverage, and continuously optimizing detection and investigation workflows.
Youll collaborate closely with Product, Engineering, and Customer Success to ensure our Auto-Triage engine reflects the latest adversarial techniques and real-world SOC operations.

Responsibilities:
Serve as a domain expert in SOC workflows, alert triage, and incident response.
Design and maintain triage logic, playbook blueprints, AI Agents and more for responding to security events.
Develop and maintain alert enrichment, correlation, and classification rules across multiple data sources (EDR, SIEM, Identity, etc.).
Collaborate with product teams to define use cases, threat coverage, and analyst workflows.
Analyze real-world alerts, telemetry, and incident data to enhance product accuracy, reduce false positives and improve incident handling.
Evaluate and curate threat intelligence feeds and sources to support automated decision-making.
Conduct post-incident reviews to extract lessons and update triage logic accordingly.
Stay current with emerging threats, attacker TTPs, MITRE ATT&CK, and other frameworks.
Assist with quality assurance, testing, and validation of triage logic before deployment.

We are looking for a SecOps Engineer to join our Security Operations team. In this role, you will help defend the organization end-to-end, from IT security to cloud security - while performing third-party and internal security reviews, handling incident response, conducting threat hunting, and supporting GenAI security work.

Responsibilities:
Design, operate, and improve security infrastructure by maintaining core controls, hardening systems, and leading cloud security efforts to address misconfigurations, vulnerabilities, and identity risks.
Monitor, investigate, and remediate security alerts and threats by performing DFIR, analyzing attack vectors, proactively hunting adversary activity, and leading incident response.
Perform security reviews of third-party vendors, SaaS platforms, and internal applications, assessing architectures, data flows, integrations, and risk exposure.
Defend the organization end-to-end across endpoints, identities, applications, and cloud by operating and advancing SecOps controls (SIEM/EDR/CSPM), building automations, enforcing best practices, and partnering cross-functionally to drive security outcomes.