Principal Threat Researcher

Bellevue · Remote · San Jose · Santa Clara · USD 171,500-245,000 · 12+ years experience · Posted Oct 1, 2026

At a glance

The Principal Threat Researcher serves as a subject matter expert on adversary behavior across endpoint and cloud environments.
This role involves dissecting and replicating sophisticated cyber attack techniques to develop scalable detection recommendations.
The researcher will influence product strategy and engineering efforts to ensure industry-leading protection for customers.

Scope and refine research initiatives applying an adversarial mindset to emerging attack techniques.
Analyze detection data sources across operating systems and major Cloud/SaaS providers.
Dive into technical components and detection optics to understand adversary manipulation of techniques.
Engineer automated attack code and develop proofs of concept for new detections.
Validate threat coverage by writing test code.
Collaborate with detection engineers, intelligence analysts, and threat hunters to prioritize deliverables.
Document and present research findings to internal and external audiences.
Serve as a technical mentor for junior team members.

12+ years of experience conducting security research with actionable outcomes.
Foundational understanding of AI/ML technologies and experience leveraging or securing AI-driven solutions.
Extensive security expertise in at least one operating system (Windows, macOS, or Linux).
Experience working with commercial Endpoint Detection & Response (EDR) platforms.
Security experience in at least one cloud service provider (AWS, GCP, or Azure) and cloud-based detection platforms.
Software development experience in at least one scripting language (e.g., PowerShell, Python).
Software development experience in at least one compiled/assembled language (e.g., C, C++, Rust, Go).
Experience managing code with version control systems like git/GitHub.

Proven ability to leverage AI technologies and workflows to drive measurable operational efficiency.
Established record of public community engagement, such as conference talks, technical blog posts, or webinars.
Prior experience developing relationships with security vendors to drive product enhancements.
Experience building attack technique automation frameworks.

Show all 15 skills