Threat Research Engineer

This role is for one of the Weekday's clients

Salary range: Rs 3000000 - Rs 5000000 (ie INR 30-50 LPA)

Min Experience: 6 years

Location: Remote (Poland)

JobType: full-time

We are seeking a Threat Research Engineer who thrives on deep data exploration, building scalable pipelines to process high-volume security telemetry, and transforming threat insights into actionable detection content. This role involves conducting original research on emerging threats and directly shaping how customers defend against them. As part of an early-stage, fast-paced startup environment, you’ll have ample opportunities to build foundational engineering systems from the ground up.

Key Responsibilities

• Collaborate with customers and internal teams to deliver impactful threat research and detection capabilities.
• Respond to incidents and perform threat detection in SaaS and cloud environments (operational experience is a plus).
• Represent the company at conferences and evangelize advanced threat detection techniques.
• Design and implement data reduction and aggregation pipelines to surface security insights from large-scale, noisy datasets.
• Research emerging threats across cloud, endpoint, and identity domains, translating findings into high-quality detection content.
• Author scalable detection logic (queries, rules, models, enrichment pipelines).
• Validate detection efficacy through simulations, adversary emulation, and dataset analysis.
• Share knowledge with the security community by documenting research, detections, and analysis methods.
• Contribute to the evolution of detection engineering frameworks and methodologies.

Environment & Technology

• Work with Detection-as-Code frameworks (experience is a plus).
• Write detection logic in multiple query languages.
• Develop in Python and Go (experience with other languages is welcome).
• Use search and analytics platforms such as Elasticsearch, OpenSearch, SQL engines, and data lakes.
• Operate in cloud-native environments across AWS, Azure, and GCP.

Ideal Candidate Profile

• Strong background in building detection content for SIEM, EDR, or cloud-native telemetry.
• Skilled in large-scale data analysis, including log/telemetry parsing, enrichment, and aggregation.
• Knowledgeable in attacker tactics and techniques (MITRE ATT&CK, threat intel, adversary emulation).
• Proficient in writing scalable detection logic in languages such as Sigma, SQL, Python, or DSLs (e.g., KQL, Splunk SPL, Elastic DSL).
• 3+ years of experience in SOC, threat research, or detection engineering.
• Operates with autonomy, balancing deep research with practical delivery in a fast-paced startup setting.
• Holds a Bachelor’s or Master’s degree in Computer Science, Information Systems, Cybersecurity, or related field (or equivalent hands-on experience).

Skills

• Threat Detection
• Threat Research
• Data Analysis & Aggregation
• Detection Engineering (SIEM, EDR, Cloud Telemetry)
• Adversary Emulation
• Cloud Security (AWS, Azure, GCP)