Security Researcher Remote (EU)

Weve Security Limited; Union (NJ); Remote; USD 120,000 - 160,000; Full time

Job summary

Weve is building workplace security for a world where people and AI agents work across dozens of systems. You will join a team researching misuse of legitimate access and unusual activity to design precise detections and investigations.

You’ll partner with engineering to define observable behavior, collect data requirements and establish how a detection is useful, scalable and auditable. Remote work is supported.

Qualifications

• Hands-on experience in detection engineering, incident response or threat research.
• Ability to reconstruct activity from audit logs and explain what logs establish or do not establish.
• Practical scripting and data-analysis skills to test hypotheses and create repeatable research.
• Good judgement about evidence, privacy and authorisation when investigating activity.
• Clear writing: explain a detection’s assumptions, failure modes and validation approach.

Responsibilities

• Research misuse of legitimate access, risky sharing, unusual agent activity and related workplace threats using authorised environments and evidence.
• Specify the signals, relationships, history and peer context needed to distinguish a credible risk from normal work.
• Develop investigation approaches that seek supporting evidence and benign explanations with clear limits on conclusions.
• Build representative evaluation cases, including near misses and legitimate behaviour that resembles an attack.
• Work with applied AI and engineering to turn research into detections, investigation tools and measurable evaluation criteria.
• Review customer findings with field engineering to improve the system.

Skills

Detection engineering

Incident response

Threat research

Scripting

Data analysis

Written communication

Tools

Python

SQL

Job description

Weve is building workplace security for a world where people and AI agents work across dozens of systems. We connect activity, identity and business context so security teams can investigate risks that no single tool can explain on its own.

A large download, a new source IP or an AI tool touching an unfamiliar repository can be legitimate work. It can also be the start of an incident. We’re looking for a researcher who can turn that ambiguity into precise hypotheses, useful detections and investigations that test competing explanations.

Your work will span workplace applications, identity, cloud activity and AI usage. You’ll partner with engineering to make research operational: define the observable behaviour, identify the data required and establish how we know a detection is useful.

What you’ll own

• Research misuse of legitimate access, risky sharing, unusual agent activity and related workplace threats using authorised environments and evidence.
• Specify the signals, relationships, history and peer context needed to distinguish a credible risk from normal work.
• Develop investigation approaches that seek both supporting evidence and benign explanations, with clear limits on what can be concluded.
• Build representative evaluation cases, including near misses, incomplete telemetry and legitimate behaviour that resembles an attack.
• Work with applied AI and engineering to turn research into maintained detections, investigation tools and measurable evaluation criteria.
• Review customer findings with field engineering and use disagreements, false positives and missed context to improve the system.

What you’ll bring

• Hands-on experience in detection engineering, incident response, threat research or a closely related security discipline.
• The ability to reconstruct activity from audit logs and explain what those logs do and do not establish.
• Practical scripting and data-analysis skills to explore behaviour, test hypotheses and create repeatable research.
• Good judgement about evidence, privacy and authorisation, especially when investigating employee activity.
• Clear writing: you can explain a detection’s assumptions, likely failure modes and validation approach to another engineer.

Useful, but not required

Identity and SaaS security, behavioural detection, insider risk, agent tool use or evaluation of AI-generated investigations.

What good looks like

• Research produces detections with explicit data requirements and understandable failure modes.
• Evaluation includes legitimate lookalikes, so improvements reflect better judgement rather than more alerts.
• Investigations leave a reviewer able to understand the evidence, uncertainty and reason for escalation.

Working here

You’ll work directly with the people building and selling Weve. We expect you to question the brief, make decisions within your area and follow through after something ships. Customer evidence matters more than how convincing an idea sounds in a meeting.

We work remotely and write down our decisions so people can make progress without waiting for everyone to be online. Read more about the team and why we’re building Weve .