דרושים » אבטחת מידע וסייבר » Staff Security Researcher- Detection AI Research

Were looking for people who are relentlessly curious and committed to continuous learning. AI is reshaping every function across our business, and we enable every team member, regardless of role or level, to build fluency in AI tools and concepts. Those who thrive here actively seek out new solutions, experiment thoughtfully, and apply what they learn to drive better, faster, smarter outcomes.
Join the Detection AI Research team, where security research meets machine learning. We use EDR telemetry from millions of endpoints to hunt for sophisticated, highly evasive attacks and to close the coverage gaps they expose, using ML models and LLM-based agents that we design, build, and run in production. As a Senior Security Researcher in our AI Detection research team, you will bring the attacker's-eye view: which techniques matter, how they look in endpoint data, and what separates a real intrusion from benign noise at scale. You will work alongside the data scientists who build our models, and your detections will reach real customers through Wayfinder analysts, threat hunters and detection engines.

Required Principal / Sr. Principal Security Research - Advanced Cyber Research (Cortex)
We are seeking a visionary and highly technical Principal / Sr. Principal Security Researcher to join our security research team. In this role, you will be at the forefront of innovating automated defense systems to rapidly protect platform customers against advanced cyber threats at an unprecedented scale. This position offers a unique opportunity to blend deep traditional cybersecurity expertise - including OS internals, reverse engineering, and advanced detection engineering with cutting-edge AI technologies like LLMs, SLMs, and agentic workflows.
You will spearhead the creation of innovative prevention solutions, leveraging massive streams of agent telemetry to design AI-driven logic that neutralizes threats before they execute. As a key technical leader, you will partner closely with top-tier data scientists and product engineers to translate cutting-edge security research into production-grade capabilities, ensuring we stay ahead of the evolving threat landscape.
Key Responsibilities:
Develop Automated Defense Systems:Create, engineer, and deploy automated solutions for the prevention and detection of advanced cyber threats, analyzing complex data to rapidly protect platform customers at scale.
Innovate with AI:Partner closely with data scientists to leverage LLMs, SLMs & deeplearning techniques to fuel these advanced prevention solutions and automated defense capabilities.
Research, develop, and continuously improve the Agentix solution. Drive the development of next-generation security content by designing and implementing specialized AI agents to automate security operations and workflows.
Drive Security Innovations:Spearhead new research initiatives from the ground up. Act as the primary driver across key stakeholders, leading top-tier data scientists and engineers to ensure the successful delivery of enterprise-grade security capabilities.

We are seeking an AI Security Researcher to join Dashs core research team. Youll investigate how AI agents - spanning coding agents, SaaS AI platforms, cloud, and endpoints - can be abused, and design detections that stop threats before they cause impact. Each platform is different, yet they share common risk patterns across prompts, tools, MCP servers, skills, hooks, identity, and data movement. Your mission is to master both: uncovering unique attack surfaces while building universal, session- and intent-aware defenses. This role combines deep platform research, responsible security testing, and close collaboration with engineering to translate findings into production runtime protection. You will help define the field of Agentic Security.
Responsibilities:
Research agentic threats: Prompt injection, tool/plugin/MCP abuse, skill and hook misuse, rogue autonomy, identity misuse, data leakage, adversarial AI, and protocol exploitation across coding agents and enterprise AI platforms.
Develop runtime detections: Design detections for multiple environments (coding agents, SaaS AI, cloud, endpoints), leveraging platform hooks, APIs, telemetry, and native guardrails where available.
Analyze platform complexities: Deep-dive into architectures, permissions, workflows, and agent capabilities (MCP servers, Skills, plugins, extensions) while extracting cross-platform risk patterns.
Build scalable detection logic: Prototype and refine heuristics, signatures, and intent-aware detectors that hold up at enterprise scale with low friction for builders.
Investigate monitoring and enforcement boundaries: Push what platforms allow for visibility and control - hooks, plugins, configuration surfaces, inventory signals, and policy enforcement points.
Prototype PoCs: Validate attack paths end to end, then turn findings into production-ready signatures, heuristics, detectors, and runtime policies.
Collaborate with engineering: Embed research into Dashs detection pipelines, session-aware runtime protection, and policy/governance modules.
Stay ahead of the field: Track adversarial AI and agent security research, continuously evolving Dashs detection and enforcement coverage.

we are looking for a Lead Detection Engineer.This is an individual contributor role with full technical ownership. You'll set the direction for detection engineering: the standards, the tooling, the coverage strategy, and the automation that operationalizes it all. You'll work closely with SOC analysts and Platform Engineering to make detection a first-class engineering discipline.

Youre welcome to work in our offices in Tel Aviv, Israel

Your responsibilities will include:

Detection coverage strategy across endpoint, identity, cloud, and infrastructure - how it's measured, prioritized, and continuously improved.
Detection-as-Code pipeline: version control, testing, peer review, CI/CD, and deployment practices for all detection logic.
Architecture connecting detections to enrichment, triage, and automated response workflows.
Technical standards for how detections are designed, tested, documented, deployed, and retired.
Detection quality: fidelity metrics, false positive reduction, coverage measurement, and continuous validation loops.
Design and build high-fidelity behavioral detections across SIEM and EDR platforms.
Research emerging attacker techniques and translate threat intelligence into scalable, evasion-resistant detections.
Validate detections through threat simulations and continuous detection testing.
Partner with SOC analysts to close the feedback loop between detections and real investigations.
Define and track detection engineering metrics; communicate coverage posture and effectiveness to security leadership.
Make architectural decisions that scale as the team and organization grow.

We are looking for a Security Researcher to join our research group as part of a growing team developing Autopilot, an innovative product for autonomous investigation and response.
As a core member of the team, you'll go beyond research: youll research, design, and develop investigation modules that allow Autopilot to autonomously detect, investigate, and respond to advanced threats at a massive scale.
Youll analyze everything from new malware behaviors to attacker techniques and process activity in enterprise-scale networks, using data collected from across millions of endpoints. Your work will span identifying attack patterns and uncovering statistical anomalies, as well as validating that the system responds effectively to real-world attacks and APT campaigns using production data.
Key Responsibilities
Research and implement new autonomous methods for investigating and responding to targeted attackers, using large-scale, diverse security datasets
Develop and design the graph-based algorithms that power autonomous investigation and decision-making capabilities
Design automated incident response by developing reusable logic that transforms raw security data and alerts into clear, actionable insights.
Leverage graph algorithms, AI techniques, and statistical methods to mimic and scale human security analyst workflows
Conduct deep, hands-on investigations into modern malware, APTs, and complex attack flows to inform detection and response logic
Stay up to date with attacker methodologies, tools, and techniques (TTPs), ensuring our product remains effective against evolving threats
Contribute to a collaborative, fast-paced research team, helping shape our research strategy, improve processes, and continuously enhance the product.

We are seeking a visionary and highly technical Principal / Sr. Principal Security Researcher to join our security research team. In this role, you will be at the forefront of innovating automated defense systems to rapidly protect platform customers against advanced cyber threats at an unprecedented scale. This position offers a unique opportunity to blend deep traditional cybersecurity expertise - including OS internals, reverse engineering, and advanced detection engineering with cutting-edge AI technologies like LLMs, SLMs, and agentic workflows.
You will spearhead the creation of innovative prevention solutions, leveraging massive streams of agent telemetry to design AI-driven logic that neutralizes threats before they execute. As a key technical leader, you will partner closely with top-tier data scientists and product engineers to translate cutting-edge security research into production-grade capabilities, ensuring we stay ahead of the evolving threat landscape.
Key Responsibilities
Develop Automated Defense Systems:Create, engineer, and deploy automated solutions for the prevention and detection of advanced cyber threats, analyzing complex data to rapidly protect platform customers at scale.
Innovate with AI:Partner closely with data scientists to leverage LLMs, SLMs & deeplearning techniques to fuel these advanced prevention solutions and automated defense capabilities.
Enhance Palo Alto Networks Agentix:Research, develop, and continuously improve the Agentix solution. Drive the development of next-generation security content by designing and implementing specialized AI agents to automate security operations and workflows.
Drive Security Innovations:Spearhead new research initiatives from the ground up. Act as the primary driver across key stakeholders, leading top-tier data scientists and engineers to ensure the successful delivery of enterprise-grade security capabilities.

we are looking for a Security Researcher.
As a Senior Security Researcher, you will bridge our core research initiatives at the intersection of proactive exposure management, agentic workflows, and scalable threat modeling. We are looking for an innovator who translates complex security data into product-driven features, taking full ownership from concept to production.
What You'll Do:
Drive Product-Led Research: Translate complex, real-world security challenges into actionable, product-driven research. Take full ownership of research projects end-to-end, from identifying the security gap to collaborating with engineering to ship platform features.
Drive Proactive Exposure Management: Leverage Automated Security Control Assessments (ASCA) alongside vulnerability evaluation and prioritization to holistically assess organizational risk. Deep dive into enterprise security tools (EDR, SIEM, Firewalls, IAM, etc.) to analyze configurations, map defensive capabilities, and continuously evaluate their effectiveness against real-world threats.
Build Security Tool Integrations: Drive the technical research and define the data models required to actually build deep, functional integrations into diverse security platforms, ensuring the accurate extraction of telemetry, policies, and configuration data.
Build AI & Agentic Workflows: Define, design, and implement the logic and knowledge base that feeds Nagomi's AI-powered agents, ensuring they deliver accurate, context-aware security guidance and automated risk assessments.
Map Attack Paths: Define realistic attack flows, identify toxic combinations of misconfigurations, and surface the security gaps that help customers prioritize the risks that actually matter.
Engage with Customers: Work directly with customers to help them understand their exposure, translate your research findings into meaningful posture improvements, and gather feedback to drive product innovation.
Cross-Functional Collaboration: Partner closely with product, engineering, and data teams to embed security insights into everything we build.

We are looking for a Senior Security Researcher to join our Identity Threat Detection and Response team. In this role, you will research the evolving threat landscape and develop advanced detections to protect SAAS, Cloud, on-premises, and hybrid identities. You will focus on identifying and mitigating identity-related threats across networks, endpoints, and cloud environments, using statistical classification methods to build effective detection models and protecting customers at scale. Additionally, you will collaborate with cross-functional teams, validate detection concepts on real-world data, and continuously enhance detection capabilities to stay ahead of emerging threats.
Key Responsibilities:
Research innovative methods for detecting targeted attackers operating in endpoints, networks, cloud and SAAS environments.
Simulate real-world attacks in lab environments and conduct a deep analysis of the behavior.
Develop and refine statistics-based classification algorithms and techniques to create and improve detection models.
Research specific scenarios to enhance our model's capabilities.
Collaborate within a diverse research group, improving our research processes and leading us to be a better team creating a better product.
Stay informed on the latest APTs, attacker methodologies, and TTPs to ensure our models stay ahead of emerging threats.

We're looking for a Threat Detection Researcher to join the Threat Research team and spread the power. In this role, you will further develop the Cloud-native Threat Detection domain.
Check out some of our recent research:
Detecting Malicious OAuth Applications
Tracking TeamPCP: Investigating Post-Compromise Attacks Seen in the Wild
Discovers Cloud Email Abuse Campaign
Responsibilities
Drive the full lifecycle of security detections - from threat research and data analysis to building and shipping detection logic directly into production.
Design behavioral baselines for complex cloud environments using diverse signals, and develop high-fidelity detections based on those baselines.
Expand our detection engine with novel and high-impact telemetry sources, pushing the boundaries of what can be detected in modern cloud environments.
Conduct deep technical research into complex cloud services to uncover novel attack vectors.
Investigate real-world attacks across cloud environments, identity providers (IDPs), and infrastructure-as-a-service (IaaS) platforms.
Hunt and analyze emerging threats and active campaigns targeting the cloud ecosystem.

We are looking for a Security Researcher to join our research group as part of a growing team developing Autopilot, an innovative product for autonomous investigation and response.
As a core member of the team, you'll go beyond research: youll research, design, and develop investigation modules that allow Autopilot to autonomously detect, investigate, and respond to advanced threats at a massive scale.
Youll analyze everything from new malware behaviors to attacker techniques and process activity in enterprise-scale networks, using data collected from across millions of endpoints. Your work will span identifying attack patterns and uncovering statistical anomalies, as well as validating that the system responds effectively to real-world attacks and APT campaigns using production data.
Key Responsibilities:
Research and implement new autonomous methods for investigating and responding to targeted attackers, using large-scale, diverse security datasets
Develop and design the graph-based algorithms that power autonomous investigation and decision-making capabilities
Design automated incident response by developing reusable logic that transforms raw security data and alerts into clear, actionable insights.
Leverage graph algorithms, AI techniques, and statistical methods to mimic and scale human security analyst workflows
Conduct deep, hands-on investigations into modern malware, APTs, and complex attack flows to inform detection and response logic
Stay up to date with attacker methodologies, tools, and techniques (TTPs), ensuring our product remains effective against evolving threats
Contribute to a collaborative, fast-paced research team, helping shape our research strategy, improve processes, and continuously enhance the product