דרושים » אבטחת מידע וסייבר » Senior / Principle Security Research - Agent ML Team (Cortex)

Are you passionate about using cutting-edge technology to help protect the world against cyber threats? Do you live and breathe the cyber security world? Do you want to take part in an innovative and disruptive AI security group that has an impact on many customers?
You will be part of a strong security research and data science team who solve highly complex security challenges using disruptive technologies, AI & ML algorithms and a lot of data.
As part of that, you will take part in the design and development of new groundbreaking AI security solutions which make a direct impact on many customers.
At Palo Alto Networks we value diverse viewpoints and experiences, as we are solving complex cyber security challenges. We are committed to a safe and inclusive workspace.
Key Responsibilities
Be at the forefront of security innovation, building next-gen detection capabilities powered by AI, deep-learning, machine learning, big data, and deep threat intelligence.
Dive deep into low-level systems, reverse engineering, and file-type behavior to uncover novel attack vectors - and then turn that insight into scalable, ML-driven protections.
Work hand-in-hand with rockstar data scientists, engineers, and PMs in a fast-paced, collaborative environment where ideas move quickly from whiteboard to production.
Lead high-impact research initiatives that fuse classic security expertise with modern data science - shaping models, influencing pipelines, and driving real-world protection outcomes.
Be a key player in a multidisciplinary team where your deep security expertise will directly influence AI/ML model design, data pipeline strategy, and real-world product impact.

We are seeking a Principal/Senior Security Researcher to lead proactive research into emerging abuse patterns across agentic and modern endpoint environments. This includes browser extensions, SaaS- and web-delivered code, autonomous agents, MCPs and related tooling, and other forms of non-binary software that do not fit neatly into a traditional malware-focused model.
In this role, you will define and drive independent research initiatives rather than simply respond to predefined queues. You will conduct deep technical investigations, including reverse engineering, telemetry analysis, controlled experimentation, and data-driven validation, and translate your findings into actionable outcomes for the product. These may include detection concepts with clear success criteria, recommendations for new telemetry or platform behavior, and concise technical narratives for engineering, product, executive, or customer-facing audiences.
You will act as a senior research partner to engineering and product leadership, helping shape priorities around what to instrument, what to build, what to retire, and how to reason about ambiguous signals in production environments. The role requires strong technical judgment, strategic thinking, and the ability to turn complex research into evidence-backed product impact.
Key Responsibilities
Define and execute proactive research programs: novel attack surfaces (e.g., browser extensions, SaaS-delivered code, autonomous agents, MCP/tooling ecosystems), long-horizon threats, and systemic gaps in visibility or detection.
Perform deep technical analysis beyond routine triage: reverse engineering, behavioral modeling, data-driven hypothesis testing, and rigorous validation of findings at scale.
Set direction for how research translates into product and detection: prioritization frameworks, threat models, evaluation criteria, and standards of evidence for shipping high-impact changes.
Partner with senior engineering and product stakeholders to shape roadmap, telemetry, and architecture informed by research; influence design tradeoffs before issues appear in the field.
Lead complex, ambiguous investigations end-to-end and synthesize conclusions for executive and customer-facing audiences when stakes are high.
Represent the team through high-quality technical artifacts (e.g., in-depth publications, conference-quality work, or equivalent internal briefings) that establish external and internal credibility.

Are you an innovative security researcher with a deep understanding of Linux systems and a passion for protecting modern environments? Do you want to lead the charge in securing enterprise networks against the latest threats?
We're looking for a skilled professional to join our team, focusing on the critical and rapidly evolving fields of Linux Security. You'll be a foundational member of a new and growing team dedicated to the blue ocean of detection, developing multiple new capabilities within the largest cybersecurity enterprise in the world.
This is a unique opportunity to apply your expertise and influence the future of threat prevention-helping us build cutting-edge security solutions from the ground up.
Key Responsibilitie
Play a pivotal role in shaping the future of our security solutions.
Enhance product effectiveness by designing advanced protection components and developing sophisticated detection rules.
Research Linux OS internals, virtualized environments, and malware behaviors to inform and strengthen our attack prevention mechanisms.
Apply advanced AI and big data approaches to investigate and analyze large-scale datasets across our client base.
Lead research on novel protection concepts and bring them to production-grade quality, serving as a subject matter expert.
Stay up to date with the latest attacker methodologies, APT campaigns, and TTPs targeting Linux systems.
Conduct static and dynamic reverse engineering of Linux malware to uncover new techniques and develop mitigation strategies.
Collaborate closely with engineering, product management, and other research teams to translate research findings into production features.

Are you an innovative security researcher with a deep understanding of Linux systems and a passion for protecting modern environments? Do you want to lead the charge in securing enterprise networks against the latest threats?
We're looking for a skilled professional to join our team, focusing on the critical and rapidly evolving fields of Linux Security. You'll be a foundational member of a new and growing team dedicated to the blue ocean of detection, developing multiple new capabilities within the largest cybersecurity enterprise in the world.
This is a unique opportunity to apply your expertise and influence the future of threat prevention-helping us build cutting-edge security solutions from the ground up.
Key Responsibilitie
Play a pivotal role in shaping the future of our security solutions.
Enhance product effectiveness by designing advanced protection components and developing sophisticated detection rules.
Research Linux OS internals, virtualized environments, and malware behaviors to inform and strengthen our attack prevention mechanisms.
Apply advanced AI and big data approaches to investigate and analyze large-scale datasets across our client base.
Lead research on novel protection concepts and bring them to production-grade quality, serving as a subject matter expert.
Stay up to date with the latest attacker methodologies, APT campaigns, and TTPs targeting Linux systems.
Conduct static and dynamic reverse engineering of Linux malware to uncover new techniques and develop mitigation strategies.
Collaborate closely with engineering, product management, and other research teams to translate research findings into production features.

We're looking for a Security Researcher to join our team at the intersection of security research, AI, and product. This isn't a traditional research role - you'll be deeply embedded in how the platform is built, working side by side with R&D, Product, and AI teams to make sure security expertise is baked into every layer of what we ship. You'll own detection and analytics research across cloud, identity, endpoint, and beyond, while actively shaping how AI capabilities are applied to solve real security problems at scale.





WHAT YOU WILL DO

Research and develop sophisticated detections and behavioral analytics across multiple security landscapes - cloud, identity, endpoint, network, and application - with a focus on coverage that scales across customer environments.
Work closely with R&D, Product, and AI teams as the security authority - reviewing features, shaping designs, and ensuring security logic is sound, practical, and impactful.
Apply an AI-native approach to detection and analytics challenges - leveraging LLMs, ML signals, and AI-assisted workflows to do things that rule-based approaches can't.
Identify gaps in detection coverage and analytical capabilities, and drive those findings directly into the product roadmap.
Analyze real-world attacker techniques and translate them into detection logic, hunting content, and analytical frameworks that ship as part of the platform.
Evaluate detection quality rigorously - measuring fidelity, coverage, and performance against real attacker behavior and production telemetry.
Stay sharp on the evolving threat landscape and rapidly incorporate new techniques, campaigns, and attacker tooling into our detection library.
Contribute to external research output - blog posts, talks, open-source tooling - that reflects our depth and point of view in the security community.

We are looking for a Windows Malware Security Researcher for our Tel Aviv R&D center. You will be part of a team that is responsible for researching the most recent and advanced cybersecurity threats, as well as designing, developing, and improving Anti-Malware capabilities to protect against them. The position includes researching OS internals, picking apart malware samples, delving into the internals of Windows kernel and user-mode code, and finding ways to mitigate new attack vectors.
The proposed role will be part of the research team of the Cortex XDR endpoint protection solution.
We are seeking a highly skilled and experienced Windows Malware Security Researcher to join our growing Windows malware research team of the Cortex XDR agent group. In this role, you will play a key part in enhancing our Endpoint Detection and Response (EDR) agent by prototyping new protection components and techniques and developing advanced malware prevention strategies. You will work on identifying, analyzing, and mitigating sophisticated threats, working closely with various teams to drive innovation. A deep understanding of the Windows operating system is essential.
Key Responsibilities
Playing a pivotal role in shaping the future of our security solutions.
Enhance the effectiveness of our EDR product by designing cutting-edge protection components and developing sophisticated prevention rules.
Researching OS internals and how Windows works under the hood - leveraging this knowledge to develop and improve our anti-malware mechanisms and capabilities.
Research and lead novel protection ideas to production-grade level, serving as the feature subject matter expert.
Research new malware and APT mitigation techniques and develop corresponding capabilities (POC level), or improve existing mitigation capabilities.
Respond to malware-based security events at clients' networks.
Stay up to date with current malware and APT techniques.
Provide feedback to the product management team on new feature requests and product enhancements from our customer base.
Find new malware techniques and APT attacks, including analysis of caught-in-the-wild malware.
Operate independently end-to-end - from initial threat idea, through research and POC, to handing off a production-ready design to core agent engineering with clear specs, test cases, and edge-case analysis.
Be a team player who lifts others up - happy to jump in when a teammate is stuck on a tricky Windows internals or RE question, share what you've figured out, and generally make the people around you better.

As a Security Researcher , you will play a key role in shaping the future of modern runtime and AI security. You will investigate how real-world attacks unfold across applications and cloud environments, and turn those insights into innovative, production-grade security capabilities.

This role is ideal for a deeply technical researcher who is driven to understand attacks at their core - not just identify surface-level indicators. You will research exploitation chains, runtime behavior, attacker techniques, and emerging AI attack patterns, then apply that knowledge to build protections that are precise, resilient, scalable, and grounded in how attacks actually work.

Specifically, you will:

Research real-world attack techniques targeting modern applications, cloud-native environments, and AI-driven systems.
Design, develop, validate, and deploy detection algorithms based on technical research, large-scale runtime telemetry, threat intelligence, and exploit PoCs.
Shape the strategy for detection data collection by defining the required telemetry, collection points, and data quality standards needed to support effective protection.
Drive research efforts end-to-end, from initial exploration and technical investigation to production-grade protection capabilities for active threats.
Work closely with engineering and product teams to turn research into practical security capabilities.

We are looking for a Security Researcher who thrives on both sides of the fence. You will develop offensive tradecraft-discovering new attack vectors and writing exploits-then use that perspective to engineer robust, product-level mitigations. If youre energized by finding a novel browser attack on Monday and shipping the defense for it by Friday, this role is for you.

Key Responsibilities

Offensive Research: Discover new attack vectors, abuse patterns, and security gaps in browsers, web applications, OS internals, and enterprise workflows.
Defensive Engineering: Design and implement detections, mitigations, and security policies informed by your offensive findings; close the loop from attack to protection.
Vulnerability & Malware Analysis: Perform reverse engineering on malware, exploits, and obfuscated code across Windows, macOS, and browser environments.
Web & Browser Security: Research techniques ranging from classic vulnerabilities (XSS, SSRF) to browser-specific primitives (extension abuse, DOM manipulation, same-origin bypasses).
Supply-Chain Security: Investigate threats in software supply chains, including browser extension marketplaces and package registries.
Threat Intelligence: Correlate signals across multiple sources to identify malicious infrastructure and adversary TTPs.
Public Impact: Write technical blog posts, publish research, and represent at major security conferences (Black Hat, DEF CON, etc.).

We're looking for a research-minded, DevOps-fluent Security Researcher to own the "left" side of the platform - from source code and IaC, through CI/CD pipelines, into running cloud workloads and the sensitive data they touch. You'll trace how risk originates in a commit or a data store and follows an attack path all the way to runtime, then turn that research into the posture logic that powers our code-to-cloud, CSPM and DSPM capabilities. This role sits at the intersection of DevSecOps, cloud, data security, and AI systems.
Conduct deep technical research across the full software development lifecycle - source code, IaC, dependencies, CI/CD pipelines, artifacts, and runtime - to map the environment and discover novel risks, misconfigurations, and end-to-end attack paths (code-to-cloud), then enrich findings with context and generate meaningful, actionable remediation.
Lead research into Data Security Posture Management (DSPM): how sensitive data is stored, classified, moves, and gets exposed across cloud data stores, and translate this into data discovery, classification, and data-flow risk logic.
Correlate runtime context from our eBPF sensors with code, pipeline, and data findings to prioritize what is actually reachable and exploitable - not just theoretically vulnerable.
Research and apply AI and ML techniques to strengthen the policy engine itself - improving detection accuracy and coverage, reducing false positives, and making risk prioritization and analytics smarter across code, cloud, data, and runtime signals.
Lead product initiatives from inception to production. Collaborate closely with product, backend, and GTM, translating research into shipped product capabilities.
Define and build complex policy and risk-prioritization logic spanning code, cloud, data, and runtime.

As an AI Security Researcher , you will play a key role in shaping the future of modern runtime AI security. You will investigate how real-world attacks unfold across AI-enabled applications, agents, tools, executed in cloud environments, and turn those insights into innovative, production-grade security capabilities across our AI Security Posture Management (AI-SPM) and AI Detection & Response (AI-DR) products.

This role is ideal for a deeply technical researcher who is driven to understand AI attacks at their core - not just identify suspicious prompts or surface-level indicators. You will research how prompt injection, tool misuse, agent drift, model abuse, and other emerging AI attack techniques translate into real runtime behavior and security impact. You will then apply that knowledge to build protections that are precise, resilient, scalable, and grounded in how attacks actually work in production.

Specifically, you will:

Research real-world attacks targeting models, agents, MCP/tooling ecosystems, RAG applications, and AI-enabled production systems.
Drive research end-to-end - explore, design, develop, validate, and deploy detection logic and protections based on runtime telemetry, exploit PoCs, technical analysis, and threat intelligence.
Shape AI-SPM capabilities by identifying what telemetry, signals, and modeling are required to continuously discover AI components, classify AI behavior, map risk, and detect unsafe or anomalous usage in production.
Shape AI-DR capabilities by researching how to detect AI-driven attacks, prove runtime impact, establish causality, and distinguish failed attempts from real compromise.
Work closely with engineering and product teams to turn deep technical research into practical security capabilities that deliver clear customer value.