Security Researcher Remote (EU)

Weve Security Limited; Ireland; Remote; EUR 70,000 - 110,000; Full time

Benefits offered by this job

Remote work

Job summary

Weve is hiring a security researcher to turn ambiguity in workplace activity into precise detections and investigations. You’ll define observable behaviour, identify data needs and collaborate with engineering to operationalize research.

You’ll own detection strategies across identity, cloud activity and AI usage, and work with field teams to improve accuracy, reduce false positives, and provide clear validation results.

Qualifications

• Hands-on experience in detection engineering, incident response, threat research or related security discipline.
• Ability to reconstruct activity from audit logs and explain what logs establish or do not establish.
• Practical scripting and data-analysis skills to explore behavior and test hypotheses.
• Good judgement about evidence, privacy and authorization when investigating employee activity.
• Clear writing to explain a detection’s assumptions, failure modes and validation approach.

Responsibilities

• Research misuse of legitimate access, risky sharing, unusual agent activity and related workplace threats using authorised environments.
• Specify signals, relationships and history needed to distinguish credible risk from normal work.
• Develop investigation approaches with evidence and benign explanations, with clear limits on conclusions.
• Build representative evaluation cases, including near misses and incomplete telemetry.
• Collaborate with applied AI and engineering to turn research into maintained detections and evaluation criteria.
• Review customer findings with field engineering to improve the system.

Skills

Detection engineering

Incident response

Threat research

Scripting

Data analysis

Audit log reconstruction

Privacy & authorization

Technical writing

Job description

Weve is building workplace security for a world where people and AI agents work across dozens of systems. We connect activity, identity and business context so security teams can investigate risks that no single tool can explain on its own.

A large download, a new source IP or an AI tool touching an unfamiliar repository can be legitimate work. It can also be the start of an incident. We’re looking for a researcher who can turn that ambiguity into precise hypotheses, useful detections and investigations that test competing explanations.

Your work will span workplace applications, identity, cloud activity and AI usage. You’ll partner with engineering to make research operational: define the observable behaviour, identify the data required and establish how we know a detection is useful.

What you’ll own

• Research misuse of legitimate access, risky sharing, unusual agent activity and related workplace threats using authorised environments and evidence.
• Specify the signals, relationships, history and peer context needed to distinguish a credible risk from normal work.
• Develop investigation approaches that seek both supporting evidence and benign explanations, with clear limits on what can be concluded.
• Build representative evaluation cases, including near misses, incomplete telemetry and legitimate behaviour that resembles an attack.
• Work with applied AI and engineering to turn research into maintained detections, investigation tools and measurable evaluation criteria.
• Review customer findings with field engineering and use disagreements, false positives and missed context to improve the system.

What you’ll bring

• Hands‑on experience in detection engineering, incident response, threat research or a closely related security discipline.
• The ability to reconstruct activity from audit logs and explain what those logs do and do not establish.
• Practical scripting and data‑analysis skills to explore behaviour, test hypotheses and create repeatable research.
• Good judgement about evidence, privacy and authorisation, especially when investigating employee activity.
• Clear writing: you can explain a detection’s assumptions, likely failure modes and validation approach to another engineer.

Useful, but not required

Identity and SaaS security, behavioural detection, insider risk, agent tool use or evaluation of AI‑generated investigations.

What good looks like

• Research produces detections with explicit data requirements and understandable failure modes.
• Evaluation includes legitimate lookalikes, so improvements reflect better judgement rather than more alerts.
• Investigations leave a reviewer able to understand the evidence, uncertainty and reason for escalation.

Working here

You’ll work directly with the people building and selling Weve. We expect you to question the brief, make decisions within your area and follow through after something ships. Customer evidence matters more than how convincing an idea sounds in a meeting.

We work remotely and write down our decisions so people can make progress without waiting for everyone to be online. Read more about the team and why we’re building Weve .