Remote Detection Engineer: Threat Research & SIEM Rules

Wazuh; United States; Remote; USD 70.000 - 120.000; Vollzeit

Benefits dieser Stelle

100% remote

Home office budget

Career growth opportunities

Collaborative environment

Zusammenfassung

Wazuh is seeking early-career detection engineers to translate threat reports into precise rules that detect malicious behavior while minimizing false positives. You will read reports, map observables to MITRE ATT&CK, and craft detections for Windows and Linux.

You will join the CTI Team in a fully remote role, collaborating with the CTI director to prioritize coverage, validate detections, and improve the threat intelligence program with AI-assisted tooling.

Qualifikationen

• 1-3 years in a SOC, detection, threat hunting or threat intelligence role.
• Familiarity with MITRE ATT&CK technique IDs and sub-technique structure.
• Experience writing detection logic in at least one format (Wazuh rules, Sigma, Elastic EQL/KQL, Splunk SPL).
• Familiarity with Windows Security/Sysmon and Linux auditd/syslog telemetry.

Aufgaben

• Write and maintain Wazuh rules and decoders for adversary techniques on Windows and Linux, prioritized by the team’s threat watchlist.
• Map new and existing detection content to current MITRE ATT&CK technique and sub-technique IDs, with supporting evidence.
• Read threat reports and extract observable behaviors, log sources and fields a detection needs.
• Contribute to the team’s adversary knowledge base: profiles of threat groups and techniques they use.
• Review detections written by teammates and AI-assisted tooling; catch false positives and ensure precise mappings.
• Work with the validation engineer to confirm each rule fires against emulated activity and document evasion scenarios.

Kenntnisse

MITRE ATT&CK knowledge

English fluency

Threat detection writing

Tools

Python

Git

Jobbeschreibung

Wazuh is seeking early-career detection engineers to translate threat reports into precise rules that detect malicious behavior while minimizing false positives. You will read reports, map observables to MITRE ATT&CK, and craft detections for Windows and Linux.

You will join the CTI Team in a fully remote role, collaborating with the CTI director to prioritize coverage, validate detections, and improve the threat intelligence program with AI-assisted tooling.