דרושים » אבטחת מידע וסייבר » Threat Hunting Researcher

We're looking for a Security Researcher to join our team at the intersection of security research, AI, and product. This isn't a traditional research role - you'll be deeply embedded in how the platform is built, working side by side with R&D, Product, and AI teams to make sure security expertise is baked into every layer of what we ship. You'll own detection and analytics research across cloud, identity, endpoint, and beyond, while actively shaping how AI capabilities are applied to solve real security problems at scale.





WHAT YOU WILL DO

Research and develop sophisticated detections and behavioral analytics across multiple security landscapes - cloud, identity, endpoint, network, and application - with a focus on coverage that scales across customer environments.
Work closely with R&D, Product, and AI teams as the security authority - reviewing features, shaping designs, and ensuring security logic is sound, practical, and impactful.
Apply an AI-native approach to detection and analytics challenges - leveraging LLMs, ML signals, and AI-assisted workflows to do things that rule-based approaches can't.
Identify gaps in detection coverage and analytical capabilities, and drive those findings directly into the product roadmap.
Analyze real-world attacker techniques and translate them into detection logic, hunting content, and analytical frameworks that ship as part of the platform.
Evaluate detection quality rigorously - measuring fidelity, coverage, and performance against real attacker behavior and production telemetry.
Stay sharp on the evolving threat landscape and rapidly incorporate new techniques, campaigns, and attacker tooling into our detection library.
Contribute to external research output - blog posts, talks, open-source tooling - that reflects our depth and point of view in the security community.

The Cyber Threat Intelligence Hunter will sit within Unit 42 Managed Threat Hunting and support proactive, intelligence-led hunting across customer environments. This role combines hands-on threat hunting with cyber threat intelligence analysis, helping multinational organizations stay one step ahead of adversaries and cyber threats.
Key Responsibilities
Analyze public and private threat intelligence, Unit 42 research, adversary campaigns, malware activity, infrastructure, indicators, and TTPs.
Translate threat intelligence into actionable hunting hypotheses, investigation workflows, hunting queries, and customer-facing findings.
Execute existing threat hunting reports and hunting workflows, investigate results, and support timely customer reporting.
Investigate scheduled hunt detections and compose clear, professional reports when relevant.
Investigate hunting leads based on IOCs, threat intelligence, internal detections, customer telemetry, and emerging adversary behaviors.
Monitor the threat landscape and prepare initial context for emerging campaigns, enabling the global team to continue deeper investigation and hunting.
Collaborate with threat hunters, detection engineers, incident responders, MDR, and Unit 42 researchers to operationalize intelligence quickly and effectively.
Escalate major, unclear, or high-impact security events to the Threat Hunting leadership team when necessary.
Provide ongoing feedback on findings, hunting reports, queries, intelligence workflows, and operational processes to support continuous improvement.

our mission is to empower every person and every organization on the planet to achieve more. As employees we come together with a growth mindset, innovate to empower others, and collaborate to realize our shared goals. Each day we build on our values of respect, integrity, and accountability to create a culture of inclusion where everyone can thrive at work and beyond. In alignment with our company values, we are committed to cultivating an inclusive work environment for all employees to positively impact our culture every day. our mission is to empower every person and every organization on the planet to achieve more. As employees we come together with a growth mindset, innovate to empower others, and collaborate to realize our shared goals. Each day we build on our values of respect, integrity, and accountability to create a culture of inclusion where everyone can thrive at work and beyond. In alignment with our company values, we are committed to cultivating an inclusive work environment for all employees to positively impact our culture every day.
Responsibilities
Conduct investigations of advanced threat actor activity across cloud, identity, endpoint, and on-premises environments to identify intrusion methods, attacker objectives, and operational patterns.
Identify and track emerging threats, attacker techniques, campaigns, and trends to enable proactive detection, disruption, and defence before customer impact.
Develop detections, mitigations, and security guidance by identifying attack paths, security weaknesses, and opportunities to strengthen defensive coverage.
Build investigative tooling, automations, proof-of-concepts, and research capabilities that improve the scale and effectiveness of security investigations.
Drive product, detection, and engineering improvements by translating investigation findings into actionable changes across our company security platforms and services.
Providing recommendations to improve customers cybersecurity posture going forward and performing threat intelligence knowledge transfer to prepare customers to defend against todays threat landscape
Synthesize complex technical research into clear, actionable intelligence, reports, briefings, and recommendations for technical and executive audiences.
Advance understanding of nation-state, cybercriminal, and emerging threat actors through research, attribution, capability assessments, and adversary tracking.
Share findings, influence strategy, and drive organizational change through knowledge transfer, best practices, and adoption of security improvements.

we are seeking a Senior Threat Hunting Researcher for Unit 42s Managed Services group, a senior hands-on role combining threat hunting, detection engineering, and incident investigation experience. You will proactively hunt across diverse telemetry to identify suspicious behaviors and emerging threats that evade traditional security. A key part of the role is translating low-fidelity signals into high-fidelity hunting logic and reusable detection opportunities. You will collaborate with multiple teams to share findings, explain coverage, and support response and improvement efforts.
Key Responsibilities
Proactively hunt for suspicious behaviors, malware activity, threat actor tradecraft, and emerging campaign patterns across large-scale customer telemetry.
Build, validate, and tune hunting and detection logic across multiple data sources and security products.
Translate low-fidelity signals, alerts, incidents, and coverage gaps into high-fidelity hunting content and reusable detection opportunities.
Investigate suspicious activity using available telemetry and clearly communicate findings, limitations, and recommended next steps.
Improve detection quality by reducing false positives, increasing signal fidelity, and identifying meaningful coverage gaps.
Collaborate with MDR, Incident Response, Threat Intelligence, Product, and Engineering to improve protection and operational scalability.
Deliver clear, evidence-based reports and technical findings that help customers understand risk and improve defenses.

We're looking for a Principal Cloud Security Researcher to serve as a senior technical leader within our Research team. This is a high-impact individual contributor role -- you won't manage people, but you'll shape the direction of our entire research function, mentor researchers, and act as a force multiplier across the organization.
You'll be the person who takes a vague threat signal and turns it into a detection strategy, a published finding, or a product capability. You'll operate as a trusted deputy to the research team lead, owning the most complex and ambiguous research challenges while raising the technical bar for the team.
What You'll Do
Drive Groundbreaking Research
Own and drive our most critical research initiatives end-to-end - from initial threat hypothesis through detection logic, product integration, and external publication.
Set the technical direction for cloud threat research across AWS, Azure, and GCP, identifying emerging attack surfaces and novel techniques before they become mainstream threats.
Investigate real-world cloud and SaaS security incidents, dissecting attacker tradecraft and extracting insights that evolve our detection capabilities.
Pioneer new forensic investigation techniques and detection methodologies for cloud-native and SaaS environments - pushing the state of the art, not just following it.
Be a Voice in the Community

Represent our company as a thought leader through high-quality research publications, conference presentations (BlackHat, DEF CON, RSA, fwd:cloudsec, and similar venues), and open-source contributions.
Build and maintain our reputation as a research-driven company that advances the field - not just a vendor with a blog.
Engage with the broader security research community, fostering relationships and collaborative knowledge-sharing.
Shape the Product

Bridge research and product - translate threat findings into actionable product requirements, working closely with engineering and product teams to ensure our CDR platform stays ahead of evolving threats.
Design and develop advanced detection algorithms that directly feed into our platform, closing the gap between research insight and customer protection.
Elevate the Team
Act as the team's go-to technical authority. When researchers hit a wall on complex cloud attack chains, IAM edge cases, or detection gaps - you're who they turn to.
Mentor and grow other researchers through research reviews, pair investigations, code reviews, and by setting quality standards and methodology best practices.
Influence technical decisions org-wide - contributing to architecture, tooling, and strategic research priorities.
Step in as the research team lead's deputy when needed - driving prioritization, representing research cross-functionally, and ensuring continuity.

Required Senior Intelligence Analyst, Threat Intelligence Delivery
About the job
In this role, being onsite and embedded with a customer several days per week, you will leverage our cyber threat intelligence to enable network defenders and customer Cyber Threat Intelligence (CTI) teams to defend against the threats they face. You will be supported and enabled by a network of colleagues and specialists right across Threat Intelligence and will contribute to our wealth of technical skills and CTI knowledge. You will have access to industry leading tooling and data and will work towards delivering on customer priority intelligence requirements. You will be supporting the customer's CTI defensive mission, helping their Security Operations Center (SOC), threat hunters, detection engineers, and CTI analysts counter threats and enable the safe and secure running of their networks and operations.
A recognized leader in dynamic cyber defense, threat intelligence and incident response services. Mandiant's cybersecurity expertise has earned the trust of security professionals and company executives around the world. Our unique combination of renowned frontline experience responding to some of the most complex breaches, nation-state grade threat intelligence, machine intelligence, and the industry's best security validation ensures that Mandiant knows more about today's advanced threats than anyone.
Responsibilities
Build an understanding of the customers' CTI requirements. Identify their needs and opportunities for deployment of CTI within their operations to have the greatest defensive impact.
Track, research and contribute CTI analysis within Threat Intelligence, of customer's priority threat concerns.
Enable customer SOC analysts and Hunt teams to deploy and leverage our CTI.
Generate CTI and perform analysis of customer data, taking their bespoke sources to identify threat activity, or to build and automate investigative workflows.
Support the integration of CTI into customer's security processes and technologies, including Security Information and Event Management (SIEM) and Threat Intelligence Platform (TIP) systems. Write intelligence reporting against customer requirements, appropriate for their intelligence analysts or executive readers.

our company Research (CPR) is looking for a Threat Researcher to join its Threat Intelligence Analysis (TIA) team. The team is responsible of discovering, analyzing and tracking advanced threat actors and campaigns, with a strong focus on high-end cybercrime and state-sponsored activities. You will join a team of motivated, independent & highly technical individuals and contribute the effort to protect our company customers and empower the company brand.
Key Responsibilities
Identify, understand and monitor advanced campaigns using publicly available sources as well as internal telemetry.
Analyze malware and other hacking tools utilized by threat actors in active campaigns and intrusions.
Create technical research content for public and private intelligence reports.
Help build protections and detections based on deep understanding of advanced threat actors Tactics Techniques and Procedures (TTPs).
Collaborate with other security teams to assist threat intelligence and research tasks.

Were looking for a top-notch Threat Detection Researcher to join our team and spread our power. In this role, you will further develop the Runtime Sensor as part of our threat research team.
WHAT YOULL DO
Develop detections and tools to protect customers from cloud threats
Investigate attacks on cloud environments and malware targeting cloud and AI workloads
Hunt and analyze real-world attacks and emerging cloud and AI threats
Collaborate closely with the R&D team to transform research insights into product features
Work with customers in response to requests related to suspicious activity or potential incidents
Create best practices and security policies based on research findings
Deliver external-facing content (blog posts and talks at security conferences) based on security insights and novel research.

we are looking for a Security Analyst to join our team and help customers strengthen their cloud security posture. In this role, you'll investigate security findings, analyze cloud environments, identify security risks, and provide customers with clear, actionable recommendations.
You'll work closely with Customer Success, Product, and R&D to improve our platform, enhance detection capabilities, and help shape the future of AI-driven cloud security.
If you're passionate about cybersecurity, enjoy solving complex security challenges, and want to make an impact in a fast-growing startup, we'd love to hear from you.

Responsibilities
Investigate security findings, customer environments, and cloud security risks.
Analyze Application Security, API Security, and Product Security vulnerabilities.
Review and tune security detections to improve accuracy and reduce false positives.
Stay up to date with emerging threats, attack techniques, and malware trends.
Respond to customer questions and provide clear, actionable security guidance.
Create concise investigation reports and security recommendations for customers.
Work closely with Customer Success and participate in customer calls when needed.
Collaborate with Product and R&D to improve platform capabilities, investigation workflows, and detection quality.

We are seeking a Principal/Senior Security Researcher to lead proactive research into emerging abuse patterns across agentic and modern endpoint environments. This includes browser extensions, SaaS- and web-delivered code, autonomous agents, MCPs and related tooling, and other forms of non-binary software that do not fit neatly into a traditional malware-focused model.
In this role, you will define and drive independent research initiatives rather than simply respond to predefined queues. You will conduct deep technical investigations, including reverse engineering, telemetry analysis, controlled experimentation, and data-driven validation, and translate your findings into actionable outcomes for the product. These may include detection concepts with clear success criteria, recommendations for new telemetry or platform behavior, and concise technical narratives for engineering, product, executive, or customer-facing audiences.
You will act as a senior research partner to engineering and product leadership, helping shape priorities around what to instrument, what to build, what to retire, and how to reason about ambiguous signals in production environments. The role requires strong technical judgment, strategic thinking, and the ability to turn complex research into evidence-backed product impact.
Key Responsibilities
Define and execute proactive research programs: novel attack surfaces (e.g., browser extensions, SaaS-delivered code, autonomous agents, MCP/tooling ecosystems), long-horizon threats, and systemic gaps in visibility or detection.
Perform deep technical analysis beyond routine triage: reverse engineering, behavioral modeling, data-driven hypothesis testing, and rigorous validation of findings at scale.
Set direction for how research translates into product and detection: prioritization frameworks, threat models, evaluation criteria, and standards of evidence for shipping high-impact changes.
Partner with senior engineering and product stakeholders to shape roadmap, telemetry, and architecture informed by research; influence design tradeoffs before issues appear in the field.
Lead complex, ambiguous investigations end-to-end and synthesize conclusions for executive and customer-facing audiences when stakes are high.
Represent the team through high-quality technical artifacts (e.g., in-depth publications, conference-quality work, or equivalent internal briefings) that establish external and internal credibility.