Be part of the team that defends the networks the world depends on

Corelight defends the world’s most sensitive networks—from global commerce to national defense—quietly, relentlessly, and with resolve. As cyber threats grow faster and smarter, we serve as the trusted force behind network resilience, putting elite defense within reach.

By transforming digital footprints from physical, virtual, and cloud networks into actionable insights, we empower defenders to illuminate blind spots and stay ahead of an evolving threat landscape. Built on open-source innovations and fueled by industry leading agentic AI technology, Corelight helps teams to detect advanced threats and close cases with unprecedented clarity and precision.

We are currently seeking an Account Executive to drive sales into the Dallas territory. The Account Executive will be responsible for developing and managing relationships with internal and customer partners, including c-suite decision makers within a geographic territory.

Key Responsibilities:

Develop and close business to consistently meet or exceed quarterly sales quotas in a way that reflects Corelight values.
Be a relentless and trusted advisor by deeply understanding client businesses, proactively identifying their needs, and driving progress through aligning Corelight solutions with their goals.
Demonstrate a deep understanding of Corelight offerings and their value to customers.
Display versatility in selling across all organizational levels, from end-users to C-suite executives, by providing industry insights, building relationships, and positioning solutions that address business needs.
Align with Corelight partner ecosystem to optimize market opportunity.
Maintain accurate pipeline management with expert level forecasting.
Leverages and aligns cross-functionally on strategy to achieve company objectives.
Regional travel required.

Qualifications:

Minimum 3-5+ years successfully selling enterprise SaaS solutions in the cloud/security space to enterprise customers within a geographic-based territory or in named accounts.
Experience managing multiple stakeholders and selling into integrated tools.
Expert in value-based solution selling, with a keen focus on delivering tangible business outcomes.
Must demonstrate proficiency in executing a formal sales process and possess familiarity with qualification frameworks.
A proven track record managing accounts in the cloud or cybersecurity ecosystem.
Ability to learn and explain a highly technical product to technically astute buyers.
BA or equivalent. Technical or business field preferred, or add 4 years relevant cyber security experience.

Notice of Pay Transparency:
The compensation for this position may vary depending on factors such as your location, skills and experience. Depending on the nature and seniority of the role, a percentage of compensation may come in the form of a commission-based or discretionary bonus. Equity and additional benefits will also be awarded.

Compensation Range

$280,000—$320,000 USD

Why Join Us?

Fueled by investments from top-tier venture capital organizations such as Crowdstrike, Accel and Insight, Corelight is one of the fastest growing network detection and response platforms in the industry. Our passionate team thrives in a collaborative, inclusive, and geographically distributed culture. We embrace diverse perspectives, neurodiversity, curiosity and low ego results - fostering an environment where every innovator can solve the toughest challenges in cybersecurity and contribute their best work.

We are looking forward to meeting you. Check us out at www.corelight.com

Compensation Range 280000 - 320000 USD

About the company

Corelight provides network detection and response (NDR) technology to improve cybersecurity. It collects and analyzes network data through the Open NDR Platform and the Cloud Sensor for AWS, giving customers visibility, aiding threat hunting, and speeding up incident response across on-premise and cloud environments. What sets Corelight apart is its open, partner-friendly approach that lets other security vendors build analytics on top of its technology, with interoperability across major vendors and a cloud-native option for AWS. The goal is to strengthen cyber defense by delivering scalable network visibility and fast detection, growing adoption through direct sales and partnerships that integrate Corelight’s Open NDR technology into other offerings.

Company Size

201-500

Company Stage

Series E

Total Funding

$309.2M

Headquarters

San Francisco, California

Founded

2013

Get referred to Corelight

See people who can refer or advise you

Simplify's Take

What believers are saying

September 15, 2026 launches add NLQ, Agent Builder Library, and AI threat detections.
July 2026 Softprom opened Corelight distribution across 15 countries, widening EMEA reach.
July 27, 2026 Amanda Berger as CCO targets renewals, expansion, and lower churn.

What critics are saying

CrowdStrike, Cisco, and Palo Alto sell adjacent platforms that compress Corelight deals.
September 2026 AI features still depend on trust in a niche network-forensics workflow.
If customers standardize on endpoint-first stacks, Corelight becomes a costly second platform.

What makes Corelight unique

Zeek-born Open NDR turns raw network traffic into auditable evidence.
Passive sensors see unmanaged, IoT, and cloud assets without endpoint agents.
Partner-friendly integrations let CrowdStrike Charlotte AI and others consume Corelight evidence.

Help us improve and share your feedback! Did you find this helpful?

Benefits

Remote Work Options
Flexible Work Hours
Company Equity

Growth & Insights and Company News

Headcount

6 month growth

1 year growth

2 year growth

PR Newswire

Sep 15th, 2026

Corelight's latest release breaks down barriers to AI SOC adoption and expands AI Threat Detection.

Corelight's latest release breaks down barriers to AI SOC adoption and expands AI Threat Detection. Sep 15, 2026, 08:00 ET New capabilities give SOC teams deterministic, exportable, auditable AI investigation and eliminate workflow friction across the security stack SAN FRANCISCO, Sept. 15, 2026 /PRNewswire/ - Corelight, a leader in enabling the defensible AI SOC, today announced new solutions to accelerate the adoption of the AI SOC without surrendering the transparency, auditability, and control that network defense demands. Corelight released the Agent Builder Library and Natural Language Query to best leverage the speed and functionality of AI and address the state of constant vulnerability most enterprises now face. Corelight is also expanding its detection coverage beyond identifying which AI applications are in use to catching AI supply-chain compromise, anomalous AI activity, and stealth command-and-control (C2) and exfiltration - all feeding directly into the same expert-authored, auditable investigation logic behind its AI capabilities. Attackers are using AI models to accelerate vulnerability discovery and exploitation, compressing the window defenders have to respond. While typical enterprise patching cycles can still run from 60 to 150 days, the median time to exploit has fallen to roughly five days. In addition, with Mythos-class AI models, defenders are expecting to see vulnerabilities exploited before there is broad knowledge that there is even a hole to be patched. Faster patching simply is not the answer - AI-speed attacks require AI-speed defense. However, widespread adoption of AI in the SOC is progressing slower than attacker adoption of AI, held back by two persistent barriers: a network expertise gap and a query language expertise gap. Corelight's latest release eliminates both. "The instinct is to fight AI-speed attacks with AI-speed defense, and that's right. But speed without expertise is just fast guessing," said Vijit Nair, senior vice president of product at Corelight. "We've packaged a decade of network forensics knowledge into building blocks that any AI agent can execute, whether it's ours or the customer's own. The result is an AI investigation that's transparent enough for a skeptical analyst to verify line-by-line, accessible enough for a day-one hire to use immediately, and operational enough to put these agentically validated, pre-triaged threats directly in front of the human as quickly as possible." Corelight has spent more than a decade turning ground-truth network evidence into the standard that the most attacked, hardened security teams rely on. Earlier this year, Corelight also introduced Agentic triage, category-first AI capabilities that help modern SOCs automate the most repetitive tasks consuming security teams, dramatically improving analyst efficiency and speed while also building trust through complete transparency. This launch extends that same expertise into tools that let every SOC operate as elite network defenders, ready to combat the most challenging cyber threat in history. * Corelight Agent Builder Library - Tackling the expertise barrier, Corelight provides a structured set of triage playbooks, field explanations, entity-pivoting guides, and investigation decision trees, distilled from more than a decade of Corelight's network forensics expertise. Because the logic is deterministic and documented rather than probabilistic, it is fully exportable - security teams can bring it into their own AI agents, SOAR workflows, or private LLM environments, including air-gapped and classified networks with no cloud connectivity. * Natural Language Query (NLQ) - Addressing the query syntax barrier, Corelight lets analysts ask plain-English questions about network evidence and receive working, LogScale queries that are automatically validated and executed against their data. Orchestrated AI sub-agents analyze each question, build a query plan, and return results with full chain-of-thought reasoning visible to the analyst. The generated query is editable so analysts can learn from the construction and refine as needed - removing the need to learn specialized syntax before investigating. "Security teams are increasingly investigating the use of AI to combat the accelerating speed of threat actors who have been early adopters of the technology," said Andrew Braunberg, principal analyst, Omdia. "The ability to automate security workflows are quickly becoming expected capabilities in SecOps solutions but the tools that become widely adopted in the SOC will need to do more than just automate, they will need to document, evaluate, and explain. Inspectable logic that can run outside the vendor's cloud isn't a nice-to-have anymore; for a lot of buyers, especially in regulated and air-gapped environments, it's a primary evaluation criterion." Unlike AI investigation tools that operate as opaque scoring engines, every Corelight-generated verdict is traceable to the specific playbook invoked, the behavioral signals that triggered it, and the evidence that supports it - a distinction critical to both to skeptical analysts and to regulators. The capabilities are designed to support documented, defensible incident response under frameworks such as NIS2, DORA, SEC disclosure rules, and CMMC 2.0. From Shadow AI Visibility to AI Threat Detection and Behavioral Defense Alongside these AI investigation capabilities, Corelight is expanding beyond identifying which AI applications are in use to detecting when AI-related activity becomes a security threat. New AI threat detections identify known AI supply-chain compromise indicators, suspicious AI gateway and provider activity, attacks against exposed AI infrastructure, and anomalous AI application behavior. Combined with expanded behavioral analytics for command-and-control and data exfiltration, Corelight gives defenders visibility across both emerging AI threats and the broader attacker path.The expansion adds three capabilities aimed at threats that don't leave a signature behind. * Detect known AI threats - Corelight identifies AI supply-chain compromise indicators, known exfiltration infrastructure, suspicious AI gateways and providers, and reconnaissance or exploitation attempts against exposed AI endpoints. * Detect anomalous AI activity - Application anomaly detection surfaces new or unusual AI usage and behavior that deviates from established patterns, helping analysts identify potentially compromised or misused AI applications even when no known signature exists. * Detect stealth C2 and exfiltration - Corelight combines 31-day subnet-level destination history with per-host upload baselining to surface connections to never-before-seen countries and unusual outbound data transfers, exposing C2, staging, and data theft that static blocklists or thresholds can miss. Every signal generated by the expanded Anomaly Engine feeds directly into the Corelight Agent Builder Library's playbooks and into Agentic Triage, so behavioral detections don't just fire an alert - they trigger the same expert-authored investigation logic that produces an auditable, evidence-backed verdict. About Corelight Corelight transforms network and cloud activity into evidence that security teams use to proactively hunt for threats, accelerate response to incidents, gain complete network visibility, and create powerful analytics. Corelight's customers include Global 2000 companies, major government agencies, and large research universities. Based in San Francisco, Corelight is an open-core security company founded by the creators of Zeek(R), the widely used open-source network security technology. For more information, visit www.corelight.com. SOURCE Corelight

PR Newswire

Jul 27th, 2026

Corelight appoints Amanda Berger as chief customer officer

Corelight, a cybersecurity firm specialising in network evidence platforms, has appointed Amanda Berger as chief customer officer. Berger brings over 25 years of experience in customer leadership across cybersecurity and SaaS companies. In her new role, Berger will oversee Corelight's customer success organisation, managing the complete customer journey from implementation through expansion. She previously served as chief customer officer at Employ, HackerOne, Lucidworks and RichRelevance, where she developed customer retention and expansion strategies. The appointment follows recent additions to Corelight's leadership team, including cybersecurity veteran Hatem Naguib joining the board and Tenable co-founder Jack Huffard as adviser. The company recently expanded its Open NDR platform to include passive asset classification and network performance monitoring.

Renascence

Jul 27th, 2026

Corelight names Amanda Berger Chief Customer Officer.

Corelight names Amanda Berger Chief Customer Officer. Corelight has appointed Amanda Berger as CCO, elevating post-sale customer experience to board level in a signal that retention is now a revenue priority in enterprise cybersecurity. Renascence Newsdesk What happened. Corelight, a network-detection and response security firm, has appointed Amanda Berger as its new Chief Customer Officer. The announcement marks a deliberate move by the company to elevate post-sale customer experience to the executive level, signalling that customer retention and success are now board-level priorities rather than operational afterthoughts. Berger steps into the role with a remit to oversee the full customer lifecycle - from onboarding and adoption through to long-term retention and advocacy - as Corelight competes in an increasingly crowded cybersecurity market where product differentiation alone is no longer sufficient. Why it matters. The creation or elevation of a Chief Customer Officer role is one of the clearest structural signals a company can send about where it believes competitive advantage now lives. In high-complexity B2B categories such as enterprise security, the buying decision is only the beginning of the relationship; the real value - and the real risk of churn - sits in what happens after contract signature. By installing a CCO at the executive table, Corelight is acknowledging that customer experience is a revenue function, not a support function. From a behavioural economics perspective, this matters because enterprise customers are not purely rational actors. Trust, perceived effort, and the consistency of human touchpoints all shape renewal decisions as powerfully as product performance metrics. A dedicated CCO can design the rituals, cadences and recovery moments that keep customers psychologically anchored to a vendor - reducing the cognitive ease with which a competitor can displace them. The Renascence take. Most commentary on CCO appointments focuses on the individual's credentials. The more important question is whether the organisation has genuinely restructured decision-making authority around the customer, or simply added a title to the org chart without changing how trade-offs get made. The appointment of a CCO is a hypothesis, not an outcome. The real test is whether Berger has budget authority, a seat in product roadmap discussions, and the power to override revenue-quarter thinking when it conflicts with long-term customer health. In its experience, CCOs who report to the CEO and control the full post-sale motion drive measurable NPS and net revenue retention improvements; those who sit beneath a CRO frequently become sophisticated complaint handlers. Corelight's leadership should be asked, publicly, which model they have chosen - because the answer determines whether this hire changes anything at all for their customers. This briefing was written by the Renascence newsdesk, synthesising reporting from the outlets below. Follow the links for the original coverage. More in Customer Experience Stay ahead of CX Get the signal, not the noise. The stories shaping customer experience - plus the Journal and Experience Loom - in your inbox.

WeirdWare

Jul 24th, 2026

Reconsider legacy tech and remote-access security in the AI age.

Reconsider legacy tech and remote-access security in the AI age. Corelight, Dropzone AI, Scythe, SimSpace, and Sondera launch AI proving ground. 24th July 2026 Five AI companies are teaming up to boost enterprise trust in AI agents via a new consortium. Secops-focused Dropzone AI said the new AI Proving Ground Consortium (AIPGC) will rigorously train, test, and prove agentic AI defences in production-like environments. Edward Wu, founder and CEO of Dropzone AI, said enterprises need to know they can trust agentic AI. As AI takes on a bigger role, organisations need confidence on how these systems perform in real environments. "The future of the SOC is multiple AI agents working together, alongside human analysts, across investigations, threat hunting, intelligence and response," Wu said. "This consortium can help establish the benchmarks and standards organisations need to confidently adopt AI and accelerate its full operational impact on security." As a result, the first virtual event from the venture between founders Dropzone AI, Corelight, Scythe, SimSpace and Sondera was held mid-June. Peter Lee, CEO of testing platform SimSpace, the lead organiser, said AI weaponisation is a bigger problem than any organisation can handle alone. "That's why we're forming the AIPGC to pool our collective ideas and cyber expertise," Lee confirmed. "AI is transforming cybersecurity. Organisations need a way to rigorously train, test, and validate AI agents together with human cyber operators." AI agents in secops and services. Dropzone AI's agentic secops offering targets managed security services providers (MSSPs). As a result, it has rolled out AI SOC Analyst, enabling autonomous investigation of more alerts and AI Threat Hunter, which runs prebuilt or custom 'hunt' packs for SIEM, EDR, and cloud. In addition, it offers AI Threat Intel Analyst, which analyses and designs responses for the AI Threat Hunter agent. "SimSpace research found that nearly 80% of security leaders report high confidence in their AI defences," the announcement said. "Measured readiness scores can be as low as 30% before repeated simulation exercises." Additionally, many organisations rely on legacy preparation strategies, like tabletop exercises and certification courses, it said.

HiTech.Expert

Jul 13th, 2026

Softprom deploys Corelight Open NDR platform in 15 countries.

Softprom deploys Corelight Open NDR platform in 15 countries. 13.07.2026 Softprom, a leading international Value Added IT distributor, has officially announced the signing of an exclusive partnership agreement with Corelight, a recognized technology leader in the field of enabling modern artificial intelligence-based cybersecurity control centers (AI SOC). Obtaining the status of an official distributor will allow Softprom to deliver advanced network threat detection and response (NDR) solutions to the markets of Central and Eastern Europe, the Caucasus and Central Asia. The geographical scope of the agreement covers 15 countries, including: Ukraine, Poland, Romania, Hungary, Bulgaria, Greece, Cyprus, Moldova, Georgia, Azerbaijan, Armenia, Kazakhstan, Uzbekistan, Kyrgyzstan and Mongolia. Corelight technology stack. Eliminating blind spots: how Corelight Open NDR works. Today's enterprise security teams are constantly faced with a lack of clear, structured, and actionable data, leading to dangerous blind spots in enterprise networks. The Corelight Open NDR platform addresses this critical issue by transforming raw network traffic into comprehensive, real-time evidence. This enables security operations centers (SOCs) to proactively hunt for threats and eliminate sophisticated attacks before they disrupt business processes. AI functionality platforms. Protection against AI threats: features of the Agentic Triage model. In 2026, the cyber threat landscape has radically changed due to the emergence of malicious autonomous Mythos-class AI models that can automatically detect vulnerabilities and weaponize them faster than engineers can deploy security patches. In such conditions, classic Endpoint Protection becomes insufficient. The Corelight platform offers the ultimate automation tools: Comparative analysis: Corelight Open NDR platforms vs. classic EDR/XDR systems. To build comprehensive protection for a modern enterprise, it is important to clearly delineate the areas of responsibility of different classes of IS solutions. Below are the architectural differences between network threat detection (NDR) platforms and traditional endpoint protection systems (EDR/XDR): | Architectural criterion | Platforms Open NDR (Corelight) | Classic EDR/XDR systems | | Primary data source | Raw network traffic, protocol metadata (Zeek/Suricata), cloud traffic. Operating system logs, host file activity, endpoint processes. | | Deployment method | Passive network sensors, SPAN ports, network TAPs. Agentless. It is mandatory to install a local software agent on each device (host). | | Infrastructure coverage | 100% of devices on the network (including IoT, ACS hardware, MFPs, routers, and unknown AI assets). Only devices with supported OS (Windows/Linux/macOS) where the agent is physically installed. | | Resistance to hackers | Absolute. An attacker cannot disable or remove a passive network sensor. Vulnerable: Advanced attacks often start by forcibly disabling the EDR agent on the system. | | AI communications analysis | Continuous passive classification of GenAI services and autonomous AI model traffic. Monitoring local AI software launch processes, without deep analysis of the network context. | | Vendor Lock-in Effect | None (open source, native integration with any SIEM/SOAR platforms). High (tied to the ecosystem of a specific host protection software developer). | [Сирий трафік підприємства] | | [Пасивний TAP / SPAN] | [Corelight Open NDR] | 100% Видимість (IoT, ШІ, Хости) | | [Захищений Хост з ОС] | [Локальний Агент EDR] | Глибокий моніторинг процесів ОС Modern AI SOC architectures of 2026 are built on synergy, not exclusion. Corelight Open NDR provides the ultimate alert and context of what is happening "between devices," while EDR/XDR provides a detailed picture of the destruction directly inside the compromised host. HiTech Expert take. For HiTech Expert, Expert formulate an important infrastructure conclusion: the deal between Softprom and Corelight reflects the global shift of the cybersecurity market to autonomous AI investigation tools. In an era where vulnerability assessments become outdated faster than updates are released, passive real-time network signal analysis is the only way to protect critical perimeters. This step is of enormous importance for Ukraine. Against the background of the Ministry of Digital Transformation deploys 60 national registries based on the Diya.Engine constructor and prepares a full AI transition to the Agentic State model, protecting government data centers from AI attacks comes to the fore. Corelight Open NDR-class platforms will become a reliable umbrella for large national systems, including state AI employment platform "Obriy".

Corelight

Enterprise Account Executive

About the job