Remote Detection Engineer – Threat Rule Architect

Wazuh; United States; Remote; USD 90,000 - 130,000; Full time

Benefits offered by this job

Fully remote

Home office budget

Professional growth opportunities

Job summary

Wazuh is seeking a security detections engineer to build and maintain rules that translate threat research into actionable signals on Windows and Linux. The role combines analysis, detection engineering, technique mapping, peer review, and validation against emulated activity in a fully remote, full-time setting.

You will read threat reports, map content to MITRE ATT&CK, and contribute research on threat groups while reviewing detections for accuracy and evasion gaps.

Qualifications

• 1–3 years of experience in a SOC, detection, threat hunting, or threat intelligence role.
• Ability to write scripts in Python or a shell language such as Bash.
• Familiarity with Git and GitHub, virtualization, and Linux containers.
• Knowledge of CVEs, SOC/SIEM operations, or security hardening.

Responsibilities

• Develop and maintain detection rules and decoders for adversary techniques on Windows and Linux.
• Read threat reports to identify observable behavior, relevant log sources, and useful fields.
• Map detection content to MITRE ATT&CK techniques and sub-techniques, documenting supporting evidence.
• Contribute research on relevant threat groups and the techniques they use.
• Review teammate and AI-assisted detections for false positives, overly broad logic, and mapping errors.
• Validate rules against emulated activity and record potential evasion gaps.

Skills

Python

Shell scripting

Git/GitHub

Linux

Windows logs

Threat detection

Tools

Sigma rules

Job description

Wazuh is seeking a security detections engineer to build and maintain rules that translate threat research into actionable signals on Windows and Linux. The role combines analysis, detection engineering, technique mapping, peer review, and validation against emulated activity in a fully remote, full-time setting.

You will read threat reports, map content to MITRE ATT&CK, and contribute research on threat groups while reviewing detections for accuracy and evasion gaps.