Senior Staff Security Researcher
Zscaler · Remote - USA; Santa Clara, California, USA
About this role
**Zscaler — Senior Staff Security Researcher (Agentic Security Operations Center, Content-Layer Research)** **Location:** Remote (United States) — in-office preference for Santa Clara, CA **Type:** Full-time **Reports to:** Director of Security Research --- ## About the Role Zscaler accelerates digital transformation with the **Zscaler Zero Trust Exchange**—a SASE-based, in-line cloud security platform protecting thousands of customers from cyberattacks and data loss. In this critical **individual contributor** role, you will lead the **content layer** for an **Agentic SOC**. You’ll architect **connectors, normalization mappings, and security data models** that transform raw telemetry from dozens of enterprise vendors (EDR, identity, cloud, network, and vulnerability feeds) into structured context that **AI agents can reason over**. You’ll govern **data quality** and drive measurable improvements in the **accuracy and reliability** of agentic conclusions. --- ## What You’ll Do - Monitor, inspect, and evaluate agentic incidents and investigations across customer environments, performing **root-cause analysis** across source alerts, data pipelines, and agent reasoning to provide **evidence-backed feedback** to the AI team. - Define required **telemetry fields** and contextual requirements for analyst-grade investigations, ensuring the content layer reliably surfaces needed data across detection surfaces. - Research, analyze, and onboard end-to-end telemetry from emerging security vendor APIs and log schemas, mapping them into a **unified security data model**. - Architect **telemetry normalization**, **multi-source correlation**, and **governance frameworks** to maintain strict data integrity and consistency across hundreds of vendor mappings. - Design, implement, and benchmark **incident rules** and **triage logic** to reduce false positives and validate alert grouping precision. --- ## Who You Are - A recognized technical authority in **threat detection** and **security telemetry**, setting strategic technical standards. - An autonomous, hands-on contributor who has driven complex technical roadmap deliverables from inception to production. - Strong analytical discipline and research rigor for troubleshooting data regressions, schema inconsistencies, and model evaluation challenges. - Excellent cross-functional communication—able to explain complex technical problems to software engineers, AI researchers, and SOC analysts. - Deep commitment to **data governance** and proactive quality baselines to prevent customer-facing regressions and improve detection efficacy. --- ## What We’re Looking For - Practical experience evaluating or optimizing **AI agents**, **LLMs**, or automated reasoning workflows in security operations or threat analysis. - **10+ years** in security engineering, detection engineering, threat hunting, or threat research within an enterprise SOC, MDR provider, or security vendor. - Expertise in enterprise security telemetry schemas and trust boundaries across: - **Endpoint (EDR)** - **Identity** (Entra ID, Okta, Active Directory) - **Cloud** (AWS, Azure, GCP audit logs) - **Network** (ZTNA, proxy, firewall, DNS) - Advanced analytical/data querying skills using **SQL** (or equivalent) for baselines, impact analysis, and validation of raw telemetry. - Hands-on proficiency modifying **schemas and data pipelines** using **Python** and **JSON**, plus the ability to quickly adopt proprietary query tools
Listing freshness
CronJobs last confirmed this listing 1h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.