Senior Staff Security Researcher

Zscaler (NASDAQ: ZS) accelerates digital transformation so customers can be more agile, efficient, resilient, and secure. The Zscaler Zero Trust Exchange platform protects thousands of customers from cyberattacks and data loss by securely connecting users, devices, and applications in any location. Distributed across 200+ public data centers globally and thousands of private sites at the edge, the SASE-based Zero Trust Exchange is the world’s largest in-line cloud security platform.

We believe the future of work is Human + AI and are building an AI-native enterprise where human potential is amplified by machine intelligence to solve the world’s hardest security challenges. Driven by deep customer obsession, we are committed to the mission, outcome, and to each other. We bring these commitments to life through three core behaviors: ownership and collaboration, trust through outcomes and impact, and a challenge culture with ongoing feedback. Ready to make an impact at the company pioneering security transformation in the AI era? Join us at Zscaler.

Role

We are seeking a Senior Staff Security Researcher to join our Agentic Security Operations Center (SOC) Content-Layer Research team in a remote position within the United States (with an in-office preference for Santa Clara, CA), reporting directly to the Director of Security Research. In this critical individual contributor role, you will lead the content layer, architecting the connectors, normalization mappings, and security data models that transform raw telemetry from dozens of enterprise vendors across EDR, identity, cloud, network, and vulnerability feeds into structured context our AI agents can reason over. Partnering closely with AI engineers, platform architects, product managers, and global research teams, you will directly govern data quality and drive measurable improvements in the accuracy and reliability of agentic conclusions.

What You'll Do

• Monitor, inspect, and evaluate agentic incidents and investigations across customer environments, performing root-cause analysis across source alerts, data pipelines, and agent reasoning to supply evidence-backed feedback to the AI team
• Define necessary telemetry fields and contextual requirements for analyst-grade investigations while ensuring the content layer reliably surfaces required data across all detection surfaces
• Research, analyze, and onboard end-to-end telemetry from emerging security vendor APIs and log schemas, mapping them seamlessly into a unified security data model
• Architect telemetry normalization, multi-source correlation, and governance frameworks to maintain strict data integrity and consistency across hundreds of vendor mappings
• Design, implement, and benchmark incident rules and triage logic to eliminate false positives and validate the precision of alert grouping

Who You Are

• You are a recognized technical authority in threat detection and security telemetry who establishes strategic technical standards rather than merely executing defined tasks.
• You are an autonomous, hands-on individual contributor with a proven record of driving complex technical roadmap deliverables from inception to production.
• You bring exceptional analytical discipline and research rigor to troubleshooting complex data regressions, schema inconsistencies, and model evaluation challenges.
• You excel at cross-functional partnership, articulating intricate technical problems with clarity to software engineers, AI researchers, and SOC analysts alike.
• You are deeply committed to data governance and proactive quality baselines, preventing customer-facing regressions and continuously elevating detection efficacy.

What We're Looking For

• Practical experience working with, evaluating, or optimizing AI agents, large language models, or automated reasoning workflows in security operations or threat analysis
• 10+ years of dedicated experience in security engineering, detection engineering, threat hunting, or threat research within an enterprise SOC, MDR provider, or security vendor
• Comprehensive expertise in enterprise security telemetry schemas and trust boundaries across endpoint (EDR), identity (Entra ID, Okta, Active Directory), cloud (AWS, Azure, GCP audit logs), and network (ZTNA, proxy, firewall, DNS)
• Advanced analytical and data querying proficiency using SQL or equivalent data analysis languages to establish baselines, perform impact analysis, and validate raw telemetry
• Hands-on proficiency modifying schemas and data pipelines using Python and JSON alongside the demonstrated ability to rapidly adopt proprietary query tools and APIs
• Exceptional written and verbal communication skills capable of translating complex security telemetry and AI behaviors into actionable technical specifications

What Will Make You Stand Out

• Specialized expertise designing, evaluating, and fine-tuning multi-agent architectures or autonomous LLM reasoning frameworks for threat triage and incident response
• Strong background in offensive security, red teaming, or penetration testing with the insight to evaluate whether agent-constructed attack timelines and narratives are technically plausible
• Practical experience with open security data schemas (e.g., OCSF, ECS, Google UDM, Splunk CIM) combined with a track record of developing commercial security products in high-growth environments

#LI-RV1 #LI-Remote

At Zscaler, we are committed to building a team that reflects the communities we serve and the customers we work with. We foster an inclusive environment that values all backgrounds and perspectives, emphasizing collaboration and belonging. Join us in our mission to make doing business seamless and secure.

Our Benefits program is one of the most important ways we support our employees. Zscaler proudly offers comprehensive and inclusive benefits to meet the diverse needs of our employees and their families throughout their life stages, including:

By applying for this role, you adhere to applicable laws, regulations, and Zscaler policies, including those related to security and privacy standards and guidelines.

Zscaler is committed to providing equal employment opportunities to all individuals. We strive to create a workplace where employees are treated with respect and have the chance to succeed. All qualified applicants will be considered for employment without regard to race, color, religion, sex (including pregnancy or related medical conditions), age, national origin, sexual orientation, gender identity or expression, genetic information, disability status, protected veteran status, or any other characteristic protected by federal, state, or local laws. See more information by clicking on the Know Your Rights: Workplace Discrimination is Illegal link.

Pay Transparency

Zscaler complies with all applicable federal, state, and local pay transparency rules.

Zscaler is committed to providing reasonable support (called accommodations or adjustments) in our recruiting processes for candidates who are differently abled, have long term conditions, mental health conditions or sincerely held religious beliefs, or who are neurodivergent or require pregnancy-related support.