Role

We are seeking a Senior Staff Security Researcher to join our Agentic Security Operations Center (SOC) Content-Layer Research team in a remote position within the United States (with an in-office preference for Santa Clara, CA), reporting directly to the Director of Security Research. In this critical individual contributor role, you will lead the content layer, architecting the connectors, normalization mappings, and security data models that transform raw telemetry from dozens of enterprise vendors across EDR, identity, cloud, network, and vulnerability feeds into structured context our AI agents can reason over. Partnering closely with AI engineers, platform architects, product managers, and global research teams, you will directly govern data quality and drive measurable improvements in the accuracy and reliability of agentic conclusions.

What You'll Do

• Monitor, inspect, and evaluate agentic incidents and investigations across customer environments, performing root-cause analysis across source alerts, data pipelines, and agent reasoning to supply evidence-backed feedback to the AI team
• Define necessary telemetry fields and contextual requirements for analyst-grade investigations while ensuring the content layer reliably surfaces required data across all detection surfaces
• Research, analyze, and onboard end-to-end telemetry from emerging security vendor APIs and log schemas, mapping them seamlessly into a unified security data model
• Architect telemetry normalization, multi-source correlation, and governance frameworks to maintain strict data integrity and consistency across hundreds of vendor mappings
• Design, implement, and benchmark incident rules and triage logic to eliminate false positives and validate the precision of alert grouping

Who You Are

• You are a recognized technical authority in threat detection and security telemetry who establishes strategic technical standards rather than merely executing defined tasks.
• You are an autonomous, hands-on individual contributor with a proven record of driving complex technical roadmap deliverables from inception to production.
• You bring exceptional analytical discipline and research rigor to troubleshooting complex data regressions, schema inconsistencies, and model evaluation challenges.
• You excel at cross-functional partnership, articulating intricate technical problems with clarity to software engineers, AI researchers, and SOC analysts alike.
• You are deeply committed to data governance and proactive quality baselines, preventing customer-facing regressions and continuously elevating detection efficacy.

What We're Looking For

• Practical experience working with, evaluating, or optimizing AI agents, large language models, or automated reasoning workflows in security operations or threat analysis
• 10+ years of dedicated experience in security engineering, detection engineering, threat hunting, or threat research within an enterprise SOC, MDR provider, or security vendor
• Comprehensive expertise in enterprise security telemetry schemas and trust boundaries across endpoint (EDR), identity (Entra ID, Okta, Active Directory), cloud (AWS, Azure, GCP audit logs), and network (ZTNA, proxy, firewall, DNS)
• Advanced analytical and data querying proficiency using SQL or equivalent data analysis languages to establish baselines, perform impact analysis, and validate raw telemetry
• Hands-on proficiency modifying schemas and data pipelines using Python and JSON alongside the demonstrated ability to rapidly adopt proprietary query tools and APIs
• Exceptional written and verbal communication skills capable of translating complex security telemetry and AI behaviors into actionable technical specifications

What Will Make You Stand Out

• Specialized expertise designing, evaluating, and fine-tuning multi-agent architectures or autonomous LLM reasoning frameworks for threat triage and incident response
• Strong background in offensive security, red teaming, or penetration testing with the insight to evaluate whether agent-constructed attack timelines and narratives are technically plausible
• Practical experience with open security data schemas (e.g., OCSF, ECS, Google UDM, Splunk CIM) combined with a track record of developing commercial security products in high-growth environments

#LI-RV1 #LI-Remote