Principal Threat Researcher
Zscaler · Bellevue, Washington, USA; Remote - USA; San Jose, California, USA; Santa Clara, California, USA
About this role
**Zscaler — Principal Threat Researcher (Remote)** Zscaler (NASDAQ: ZS) accelerates digital transformation with the Zscaler Zero Trust Exchange™ platform—protecting thousands of customers from cyberattacks and data loss by securely connecting users, devices, and applications anywhere. In this role, you’ll serve as the definitive subject matter expert on adversary behavior across **Endpoint and Cloud** environments. You’ll dissect, replicate, and outmaneuver sophisticated attack techniques, then translate complex threat research into **concrete, scalable detection recommendations** that directly influence engineering priorities, product strategy, vendor telemetry, and customer protection. --- ## What you’ll do (Role Expectations) - **Scope and continuously refine** research initiatives with an adversarial mindset to analyze emerging attack techniques, customer impact, and detection data sources across at least one OS (**Windows, macOS, Linux**) and major Cloud/SaaS providers such as **AWS, Microsoft 365, and Okta**. - Deeply analyze the **technical components and detection optics** behind specific threats to understand how adversaries control and manipulate variations of a technique. - Use your **endpoint and cloud expertise** to engineer automated attack code, write test code to validate threat coverage, and develop proofs of concept for new detections. - Collaborate across Zscaler to develop **new detection methodologies** and engineering recommendations with detection engineers, intelligence analysts, and threat hunters. - **Document and present** research findings and operational deliverables in an accessible, actionable way for internal and external audiences, and mentor more junior team members. --- *Note: The provided description appears truncated after “Who You Are...”. If you share the rest, I can format the full posting as well.*
Listing freshness
CronJobs last confirmed this listing 2h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.