[Hiring] Director, Security Research @Sysdig

Role Description

You will lead the Sysdig Threat Research Team (TRT). The department has two halves, and you own both:

• Adversary research is hypothesis-driven and sets its own agenda.
• Detection engineering is demand-driven and ships the detection content our customers and the Falco community run in production.

We are hiring for AI security research specifically, not threat research generally, and we mean that in both directions:

• Research into AI-related threats: attacks on models, agents, and the infrastructure they run on.
• AI-driven research methods, where agents do reproduction, analysis, and detection authoring at a scale people cannot match.

We will prioritize candidates who have published original work on AI threats and are already building with AI-driven research methods.

The reach here is unusual, and you inherit real assets:

• Detection content this team owns ships to Sysdig customers and, through Falco, to everyone running the CNCF project we created.
• The team's published research is one of the largest drivers of Sysdig's inbound audience.
• The evidence behind that research comes from production telemetry at scale.

Own Threat Research end-to-end:

• Set the research agenda, the detection content roadmap, and the budget.
• You are the final decision-maker on what this team investigates and what it ships.

Make AI security research the center of gravity:

• Build a standing capability against model and agent abuse, agentic tool misuse, prompt-layer attacks, the AI supply chain, and attacks on the infrastructure that hosts it all.
• Turn what you find into a tuned detection and a blog post.

Lead a small team of researchers and engineers, hands-on:

• Set their technical direction, expand what each can cover, and stay close enough to the work to be credible with the people doing it.

Own the detection content that ships:

• The managed ruleset, cloud and identity detections, and the quality of all of it.
• Rule quality is a number this team moves, not a claim it makes.

Hold our own detections to the standard you would apply to someone else's product:

• Run adversarial validation against the rules we ship and drive what you find to closure.
• Coverage and evasion resistance should be engineering measurements, not an annual exercise ending in a PDF.

Own the detection platform:

• The toolchain, the attack reproduction environments, behavior-based detection, and adversary-deception telemetry.
• Build in-house reproduction for every detection family we ship.

Publish and be the public voice of this work:

• Original discovery, named campaigns, CVEs, conference stages, and open-source contribution, all resourced and expected.
• This team's output is one of the most visible things Sysdig produces.

Partner with Marketing to turn research into content and campaigns that go beyond just the technical write-up.

Convert research into field capability:

• Build a library of reusable attack demonstrations, threat briefings, and advisory content, so Sales Engineering and Customer Success can carry this research into customer conversations on their own.

Partner with Product Engineering:

• Sit with Product on where detection capability goes next, and tell them how an attacker would defeat what they are about to build.

Qualifications

• 10+ years in security research, threat research, or detection engineering.
• 4+ years leading and developing researchers, with real ownership of an agenda, its outcomes, and its budget.
• Original AI security research with published work or shipped detections.
• Hands-on experience: writing code, building tooling, and running analysis.
• Public body of work: original discovery, CVEs, named campaigns, conference talks, or open-source tooling.
• Owned detection content that shipped to real users.
• Depth in Linux, container, Kubernetes, and cloud internals at the syscall and control-plane level.
• Ability to run a research agenda alongside a detection queue with customer deadlines.
• Credibility with a customer's CISO and with your own researchers.

Requirements

• Built a research capability that didn't exist before.
• Experience with capable adversaries such as APT actors or other sophisticated offensive cyber groups.
• Open-source stewardship: maintainer or substantial contributor on a security project.
• Worked against AI security frameworks as an engineering problem.
• Research that is well received: picked up by the mainstream press, cited by CERTs, or adopted by defenders.

Benefits

• Extra days off to prioritize your well-being.
• 401(k) Retirement Savings Plan with a 3% company match.
• Maternity and Parental Leave.
• Mental health support for you and your family through the Modern Health app.
• Full health benefits package for you and your family.
• The U.S. annual salary range for this full-time position is between 245,000 and 307,000 USD/year.