Principal/Senior Security Researcher - Autonomous EDR- Windows (Cortex)
Palo Alto Networks1 month ago
Tel Aviv-Yafo, IsraelStaff+
Responsibilities
- Research and implement autonomous methods for investigating and responding to targeted attackers using large-scale security datasets.
- Develop graph-based algorithms for autonomous investigation and decision-making.
- Design automated incident-response logic that transforms raw security data and alerts into actionable insights.
- Use graph algorithms, AI techniques, and statistical methods to scale security analyst workflows.
- Conduct hands-on investigations into malware, APTs, attacker techniques, and complex attack flows.
- Track evolving attacker methodologies, tools, and techniques to improve detection and response.
- Contribute to research strategy, process improvements, and product enhancements within a collaborative research team.
Requirements
- Require 5+ years of security or threat research experience involving deep research and actionable real-world impact.
- Require experience on an R&D or development team and strong Python programming proficiency.
- Require intimate knowledge of attack methods and techniques affecting endpoints and enterprise networks.
- Require comfort working with large-scale datasets to extract meaningful insights through advanced analysis.
- Require ownership, independent project execution, critical thinking, and strong verbal and written communication skills.
- Prefer in-depth knowledge of operating-system internals, especially Windows.
- Prefer experience with graph databases and graph algorithms.
- Prefer experience in statistics, advanced data studies, or machine learning.
Benefits
- Most teams work from the office full time, with flexibility when needed.
- Palo Alto Networks provides reasonable accommodations for qualified individuals with disabilities or special needs.
- Palo Alto Networks is an equal opportunity employer.
About Palo Alto Networks
Palo Alto Networks builds cybersecurity products for enterprises and governments, including next-generation firewalls, cloud security (Prisma Cloud/Prisma Access), and SOC tools (Cortex). It sells subscriptions and appliances with cloud-delivered threat intelligence, securing networks, endpoints, and applications across data centers and public clouds. Founded in 2005 and headquartered in Santa Clara, California, the company is publicly traded on the NYSE under the ticker PANW.