Director, Security Research

Sysdig

62d•$245,000 - $307,000•Remote

About The Position

At Sysdig, we believe cloud security isn't a compromise - it's a promise. From the start, our mission has been clear: to help organizations secure innovation in the cloud, the right way. We created Falco, the open standard for cloud threat detection, and continue to lead the cloud security market with runtime insights, open innovation, and agentic Al. Creators of technology trusted by over 60% of the Fortune 500, Sysdig gives teams the real-time clarity to move fast and defend what matters most. Culture matters here. We believe diversity fuels stronger ideas, and open dialogue drives sharper decisions. Recognized as a Best Place to Work and one of Deloitte's fastest-growing companies for the past 5 years, we're here to raise the standard for what cloud security and workplace culture should be. If you have the passion to dig deeper, the desire to challenge convention, and the curiosity to build something better, Sysdig is the right place for you.

Requirements

10+ years in security research, threat research, or detection engineering.
4+ years leading and developing researchers, with ownership of an agenda, outcomes, and budget.
Original AI security research with published work or shipped detections (e.g., adversarial ML, agentic and tool-abuse attack paths, prompt-layer attacks, model supply chain, attacks on AI-serving infrastructure).
Hands-on coding, tooling, and analysis capabilities.
Experience using agents for research work.
A public body of work (original discovery, CVEs, named campaigns, conference talks, or open-source tooling).
Experience owning detection content shipped to users, with an understanding of rule effectiveness against knowledgeable attackers.
Depth in Linux, container, Kubernetes, and cloud internals at the syscall and control-plane level.
Ability to manage a research agenda alongside a customer-driven detection queue without compromising either.
Credibility with both CISOs and internal researchers.

Nice To Haves

Experience building a research capability from scratch.
Experience with capable adversaries such as APT actors or sophisticated offensive cyber groups, including attribution tradecraft.
Open-source stewardship (maintainer or substantial contributor).
Experience with AI security frameworks like MITRE ATLAS, OWASP Top 10 for LLM Applications, or NIST AI RMF as an engineering problem.
Research that has been well-received by mainstream press, CERTs, or adopted by defenders.

Responsibilities

Lead the Sysdig Threat Research Team (TRT), encompassing both adversary research and detection engineering.
Focus on AI security research, including attacks on AI models, agents, and their infrastructure, as well as AI-driven research methods.
Own Threat Research end-to-end, setting the research agenda, detection content roadmap, and budget.
Make AI security research the center of gravity, building capabilities against model and agent abuse, agentic tool misuse, prompt-layer attacks, the AI supply chain, and attacks on hosting infrastructure.
Lead a small team of researchers and engineers hands-on, setting technical direction and staying close to the work.
Own the detection content that ships, including managed rulesets, cloud and identity detections, and ensuring their quality.
Hold our own detections to a high standard through adversarial validation and driving findings to closure.
Own the detection platform, including the toolchain, attack reproduction environments, behavior-based detection, and adversary-deception telemetry.
Publish research and act as the public voice for this work, including original discovery, named campaigns, CVEs, conference presentations, and open-source contributions.
Partner with Marketing to turn research into content and campaigns.
Convert research into field capability by building a library of reusable attack demonstrations, threat briefings, and advisory content.
Partner with Product Engineering to inform future detection capabilities and provide attacker perspectives on new builds.