We are looking for a Senior Security Researcher to join our Identity Threat Detection and Response team. In this role, you will research the evolving threat landscape and develop advanced detections to protect SAAS, Cloud, on-premises, and hybrid identities. You will focus on identifying and mitigating identity-related threats across networks, endpoints, and cloud environments, using statistical classification methods to build effective detection models and protecting customers at scale. Additionally, you will collaborate with cross-functional teams, validate detection concepts on real-world data, and continuously enhance detection capabilities to stay ahead of emerging threats.
Key Responsibilities
Research innovative methods for detecting targeted attackers operating in endpoints, networks, cloud and SAAS environments.
Simulate real-world attacks in lab environments and conduct a deep analysis of the behavior.
Develop and refine statistics-based classification algorithms and techniques to create and improve detection models.
Research specific scenarios to enhance our model's capabilities.
Collaborate within a diverse research group, improving our research processes and leading us to be a better team creating a better product.
Stay informed on the latest APTs, attacker methodologies, and TTPs to ensure our models stay ahead of emerging threats.
Key Responsibilities
Research innovative methods for detecting targeted attackers operating in endpoints, networks, cloud and SAAS environments.
Simulate real-world attacks in lab environments and conduct a deep analysis of the behavior.
Develop and refine statistics-based classification algorithms and techniques to create and improve detection models.
Research specific scenarios to enhance our model's capabilities.
Collaborate within a diverse research group, improving our research processes and leading us to be a better team creating a better product.
Stay informed on the latest APTs, attacker methodologies, and TTPs to ensure our models stay ahead of emerging threats.
Requirements:
At least 5 years experience with Active Directory security and identity related attacks.
In-depth knowledge of the inner-workings of operating systems.
In-depth Knowledge of network protocols, including but not limited to Kerberos, RPC, SMB, HTTP, SMTP, DNS, DHCP, etc.
In-depth knowledge of enterprise infrastructure, including Active Directory, FW, VPN, Security products, etc.
Ability to drive and own projects from start to finish.
Independent and a team player, a critical thinker.
Preferred Qualifications
2+ years of experience with Entra ID (formerly Azure AD) or SAAS application.
At least 2 years of experience coding in Python.
Strong knowledge of SQL language.
Experience with red-teaming / pentesting of Entra ID.
Experience with machine learning, data analysis, cloud infrastructure, or security.
At least 5 years experience with Active Directory security and identity related attacks.
In-depth knowledge of the inner-workings of operating systems.
In-depth Knowledge of network protocols, including but not limited to Kerberos, RPC, SMB, HTTP, SMTP, DNS, DHCP, etc.
In-depth knowledge of enterprise infrastructure, including Active Directory, FW, VPN, Security products, etc.
Ability to drive and own projects from start to finish.
Independent and a team player, a critical thinker.
Preferred Qualifications
2+ years of experience with Entra ID (formerly Azure AD) or SAAS application.
At least 2 years of experience coding in Python.
Strong knowledge of SQL language.
Experience with red-teaming / pentesting of Entra ID.
Experience with machine learning, data analysis, cloud infrastructure, or security.
This position is open to all candidates.
