{"id":762705,"url":"https://alion.io/job/sysdig-director-security-research","title":"Director, Security Research","company":{"id":34889,"name":"Sysdig","domain":"sysdig.com","url":"https://alion.io/company/sysdig","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Lever","truth_index":null},"role":"Leadership","role_family":"Leadership","seniority":"head","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["United States"],"countries":["US"],"hiring_countries":["US"],"hiring_countries_total":1,"salary":null,"salary_estimate":{"min_usd":167000,"max_usd":301000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":727},"experience_years_min":10,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"Falco","optional":false},{"name":"Kubernetes","optional":false},{"name":"Linux","optional":false},{"name":"LLM","optional":false},{"name":"NIST AI RMF","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"Sysdig Secure","optional":false}],"status":"live","first_seen_at":"2026-09-09T14:42:29Z","employer_posted_date":"2026-09-09","last_verified_at":"2026-11-06T22:52:40Z","board_verified":true,"closed_at":null,"days_open":58,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":58},"description":"At Sysdig, we believe cloud security isn't a compromise - it's a promise. From the start, our mission has been clear: to help organizations secure innovation in the cloud, the right way.\nWe created Falco, the open standard for cloud threat detection, and continue to lead the cloud security market with runtime insights, open innovation, and agentic Al. Creators of technology trusted by over 60% of the Fortune 500, Sysdig gives teams the real-time clarity to move fast and defend what matters most.\nCulture matters here. We believe diversity fuels stronger ideas, and open dialogue drives sharper decisions. Recognized as a Best Place to Work and one of Deloitte's fastest-growing companies for the past 5 years, we're here to raise the standard for what cloud security and workplace culture should be.\nIf you have the passion to dig deeper, the desire to challenge convention, and the curiosity to build something better, Sysdig is the right place for you.\nWhat you will do\nYou will lead the Sysdig Threat Research Team (TRT). The department has two halves, and you own both. Adversary research is hypothesis-driven and sets its own agenda. Detection engineering is demand-driven and ships the detection content our customers and the Falco community run in production.\nWe are hiring for AI security research specifically, not threat research generally, and we mean that in both directions. One direction is research into AI-related threats: attacks on models, agents, and the infrastructure they run on. The other is AI-driven research methods, where agents do reproduction, analysis, and detection authoring at a scale people cannot match. We will prioritize candidates who have published original work on AI threats and are already building with AI-driven research methods.\nThe reach here is unusual, and you inherit real assets. Detection content this team owns ships to Sysdig customers and, through Falco, to everyone running the CNCF project we created. The team's published research is one of the largest drivers of Sysdig's inbound audience. And the evidence behind that research comes from production telemetry at scale.\nOversee Threat Research end-to-end. Finalize the research agenda, the detection content roadmap, and the budget. You are the tie-breaker on what this team investigates and what it ships.\n\nMake AI security research the center of gravity. Build a standing capability against model and agent abuse, agentic tool misuse, prompt-layer attacks, the AI supply chain, and attacks on the infrastructure that hosts it all. Turn what you find into a tuned detection, and a blog post.\nLead a small team of researchers and engineers, hands-on. Set their technical direction, expand what each can cover, and stay close enough to the work to be credible with the people doing it.\nOwn the detection content that ships. The managed ruleset, cloud and identity detections, and the quality of all of it. Rule quality is a number this team moves, not a claim it makes.\nHold our own detections to the standard you would apply to someone else's product. Run adversarial validation against the rules we ship and drive what you find to closure. Coverage and evasion resistance should be engineering measurements, not an annual exercise ending in a PDF.\nOwn the detection platform. The toolchain, the attack reproduction environments, behavior-based detection, and adversary-deception telemetry. Build in-house reproduction for every detection family we ship.\nPublish and be the public voice of this work. Original discovery, named campaigns, CVEs, conference stages, and open-source contribution, all resourced and expected. This team's output is one of the most visible things Sysdig produces.\nPartner with Marketing to turn research into content and campaigns that go beyond just the technical write-up.\nConvert research into field capability. Build a library of reusable attack demonstrations, threat briefings, and advisory content, so Sales Engineering and Customer Success can carry this research into customer conversations on their own.\nPartner with Product Engineering. Sit with Product on where detection capability goes next, and tell them how an attacker would defeat what they are about to build.\nWhat you will bring with you\n Have 10+ years in security research, threat research, or detection engineering, including 4+ years leading and developing researchers, with real ownership of an agenda, its outcomes, and its budget\nHave done original AI security research and can point to published work or shipped detections: adversarial ML, agentic and tool-abuse attack paths, prompt-layer attacks, model supply chain, or attacks on AI-serving infrastructure\nAre still hands-on: you write code, build tooling, and run the analysis yourself\nAre already using agents to do research work, and have opinions about where that fails\nHave a public body of work: original discovery, CVEs, named campaigns, conference talks, or open-source tooling that other people use\nHave owned detection content that shipped to real users, and know the difference between a rule that fires and a rule that survives an attacker who knows it exists\nHave depth in Linux, container, Kubernetes, and cloud internals at the syscall and control-plane level.\nCan run a research agenda with no clock on it alongside a detection queue with customer deadlines, without letting either starve the other\nAre credible with a customer's CISO and with your own researchers, without changing register much between them\nWhat we look for\nBuilt a research capability that didn't exist before, at a company where you had to define most of it yourself\nExperience with capable adversaries such as APT actors or other sophisticated offensive cyber groups, including the tradecraft of attributing them\nOpen-source stewardship: maintainer or substantial contributor on a security project with users who depend on it\nWorked against AI security frameworks such as MITRE ATLAS, the OWASP Top 10 for LLM Applications, or NIST AI RMF, as an engineering problem rather than a documentation exercise\nResearch that is well received: picked up by the mainstream press, cited by CERTs, or adopted by defenders\nWhen you join Sysdig, you can expect\nExtra days off to prioritize your well-being\n401(k) Retirement Savings Plan with a 3% company match\nMaternity and Parental Leave\nMental health support for you and your family through the Modern Health app\nFull health benefits package for you and your family","description_format":"text","description_chars":6463,"description_truncated":false,"requirements":{"experience_years_min":10,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Parental leave","Retirement plans"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cloud Security","DevSecOps","Security Operations"],"lifecycle":[{"event":"open","at":"2026-09-11T18:59:09Z"}],"visa":[{"country":"US","licensed_sponsor":true,"adverts_offering_sponsorship_24m":0,"sanctioned_now":false,"evidence":"H-1B filings in 12 months: 7 · green card filings: 5","filings_12m":7,"filings_prev_12m":19,"green_card_filings_12m":5,"median_offered_wage_usd":179583,"route":null,"cap_exempt":false,"checked_at":"2026-11-06T22:30:08+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":2}],"liveness":{"score":66,"band":"ok","label":"Likely open","p_open":1,"p_active":0.882,"p_room":0.75,"age_days":57,"expected_fill_days":64,"reasons":["conf:0","velocity","win:late"],"computed_at":"2026-11-06T05:58:05Z"},"pay":null,"html_url":"https://alion.io/job/sysdig-director-security-research","json_url":"https://alion.io/job/sysdig-director-security-research.json","meta":{"generated_at":"2026-11-06T23:13:28Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":2414,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-07T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":34889},"rest":"https://alion.io/mcp/rest/get_company?id=34889"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fsysdig-director-security-research"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fsysdig-director-security-research"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fsysdig-director-security-research"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/sysdig-director-security-research\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fsysdig-director-security-research"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":762705}},{"tool":"search_jobs","arguments":{"company":"sysdig.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":762705},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}