About the Position

We are looking for early-career detection engineers who can read a threat report and turn it into a rule that fires on the right behavior and stays quiet on everything else. We seek curious, rigorous individuals who want to learn how a threat intelligence program works from the inside.

Responsibilities

Write and maintain Wazuh rules and decoders for adversary techniques on Windows and Linux, prioritized by the team’s threat watchlist.
Map new and existing detection content to current MITRE ATT&CK technique and sub-technique IDs, with the supporting evidence for each mapping.
Read threat reports and extract the observable behaviors, log sources and fields a detection needs.
Contribute to the team’s adversary knowledge base: profiles of the threat groups most relevant to Wazuh users and the techniques they use.
Review detections written by teammates and by AI-assisted tooling; catch false positives, wrong technique IDs and over-broad logic before release.
Work with the validation engineer to confirm each rule fires against emulated activity and document what would evade it.

Requirements

1–3 years in a SOC, detection, threat hunting or threat intelligence role.
Working knowledge of MITRE ATT&CK, including technique IDs and how sub-techniques are structured.
Familiarity with Windows Security/Sysmon and Linux auditd/syslog telemetry: what each log source records and what legitimate activity looks like in it.
Experience writing detection logic in at least one format (Wazuh rules, Sigma, Elastic EQL/KQL, Splunk SPL).
Python and Git.
Fluent in English; you can explain a detection and its limits in a paragraph.
The habit of checking a claim against the primary source before repeating it.

Nice to Have

Hands-on Wazuh experience (rules, decoders, agent configuration).
Familiarity with Atomic Red Team or Caldera.
Basic malware or script analysis (PowerShell, bash).
Public contributions: Sigma rules, blog posts, CTF write-ups.

We Offer

100% remote.
Competitive salary.
Home office budget.
A forward-moving career path with professional growth opportunities.
Positive, supportive and collaborative work environment.

Skills

Git and GitHub
Virtualization systems (VirtualBox)
Linux containers (Docker)
CVE knowledge
SOC/SIEM experience
Security hardening

About the Company

Wazuh, Inc. is a company dedicated to providing advanced security solutions. Our Cyber Threat Intelligence team is at the forefront of turning knowledge of real adversaries into detection coverage for Wazuh users. We work in a small, collaborative environment with weekly cross-reviews and direct oversight from the CTI director.

Detection Engineer (Threat Research)

Job description