Threat Detection Researcher
Conducts data-driven research into emerging cloud threats and builds high-fidelity security detections for production. Requires 6+ years of security or threat research experience, strong investigation skills, and proficiency in Python, Go, and query languages.
About the job
Responsibilities
- Drive the full lifecycle of security detections, from threat research and data analysis to building and shipping detection logic directly into production.
- Design behavioral baselines for complex cloud environments using diverse signals and develop high-fidelity detections based on those baselines.
- Expand the detection engine with novel, high-impact telemetry sources for modern cloud environments.
- Conduct deep technical research into complex cloud services to uncover novel attack vectors.
- Investigate real-world attacks across cloud environments, identity providers (IDPs), and infrastructure-as-a-service (IaaS) platforms.
- Hunt and analyze emerging threats and active campaigns targeting the cloud ecosystem.
Requirements
- 6+ years of hands-on experience in security or threat research, with a track record of driving investigations to actionable, real-world impact.
- Strong self-motivation and ability to independently drive complex research projects from concept to delivery.
- Clear and effective communication and collaboration skills across teams and disciplines.
- Experience conducting data-driven research and working with large-scale telemetry.
- Proficiency in Python, Go, and query languages such as KQL and SQL.
Nice-to-haves
- Familiarity with cloud infrastructure (AWS, Google Cloud, Azure), Kubernetes, and modern cloud-native architectures.
- Background in incident response, red teaming, or threat hunting.
- Hands-on experience building and shipping security detections as part of a product.
- Experience writing technical blogs, publishing security research, or speaking at industry conferences.
- Experience leveraging AI/LLM-driven tools to enhance detection generation and telemetry analysis.
Skills
Python, Go, Kql, SQL, AWS, GCP, Azure, Kubernetes, Cloud Security, Threat Hunting, Incident Response, Red Teaming, Security Detection, Cloud-Native Architecture, Large-Scale Telemetry
Similar jobs
Security Engineering jobs
Viz.ai
Tel Aviv, Israel
Leads information security governance, compliance, security operations, risk management, and incident response for a healthcare AI company. Requires 5+ years of security experience and hands-on expertise with major compliance frameworks, SIEM, incident response, and third-party risk.
Monarch
Remote
Own and scale security governance, risk, compliance, and customer assurance programs, including audits, controls monitoring, third-party risk, policies, and security questionnaires. The role requires 3–5 years of security GRC experience and hands-on understanding of IAM, endpoint, and cloud controls.
GitLab
IsraelLeads high-severity security investigations and end-to-end incident response for GitLab’s cloud and corporate environments. The role focuses on DFIR, detection engineering, automation, AI-assisted workflows, executive communication, and improving operational maturity within a global 24/7 team.
GitLab
United StatesLeads the Product Security team responsible for security posture management, governed security rollouts, and software supply chain security across GitLab’s software factory. The role combines technical security leadership, organizational adoption, audit readiness, team building, and external thought leadership.
Vanta
Remote
Leads interpretation and productization of federal compliance controls for Vanta’s public-sector platform, translating FedRAMP and related frameworks into technically testable guidance, automated detectors, mappings, and machine-readable authorization workflows. Requires 8–10+ years of hands-on federal compliance experience, especially FedRAMP program and SSP work.