Director, Security Research

About This Role

Directing security research at Sysdig involves leading the Threat Research Team (TRT), which encompasses both adversary research and detection engineering. This role focuses specifically on AI security research, investigating AI-related threats and developing AI-driven research methods to scale analysis and detection authoring. The director will oversee the team's research agenda, detection content roadmap, and budget, ensuring the delivery of high-quality detection content to Sysdig customers and the Falco community.

Responsibilities

• Oversee Threat Research end-to-end, finalizing the research agenda, detection content roadmap, and budget
• Make AI security research the center of gravity, building a standing capability against model and agent abuse, agentic tool misuse, prompt-layer attacks, the AI supply chain, and attacks on hosting infrastructure
• Lead a small team of researchers and engineers hands-on, setting technical direction and expanding individual coverage
• Own the detection content that ships, including the managed ruleset, cloud and identity detections, and overall quality
• Hold detections to a high standard, running adversarial validation and driving findings to closure
• Own the detection platform, including the toolchain, attack reproduction environments, behavior-based detection, and adversary-deception telemetry
• Publish and be the public voice of this work through original discovery, named campaigns, CVEs, conference stages, and open-source contribution
• Partner with Marketing to turn research into content and campaigns beyond technical write-ups
• Convert research into field capability by building a library of reusable attack demonstrations, threat briefings, and advisory content
• Partner with Product Engineering on future detection capabilities and advise on potential attacker evasion methods

Requirements

• 10+ years in security research, threat research, or detection engineering
• 4+ years leading and developing researchers, with ownership of an agenda, outcomes, and budget
• Original AI security research with published work or shipped detections in areas like adversarial ML, agentic and tool-abuse attack paths, prompt-layer attacks, model supply chain, or AI-serving infrastructure attacks
• Hands-on experience in writing code, building tooling, and running analysis
• Experience using agents for research work and opinions on their limitations
• Public body of work including original discovery, CVEs, named campaigns, conference talks, or open-source tooling
• Ownership of detection content shipped to real users, understanding the difference between a rule that fires and one that survives an attacker
• Depth in Linux, container, Kubernetes, and cloud internals at the syscall and control-plane level