Threat Detection Researcher (Cloud)

Minimum Qualifications

• 6+ years of hands-on experience in security or threat research, with a proven track record of driving investigations to actionable, real-world impact.
• Experience conducting data-driven research and working with large-scale telemetry.
• Proficiency in Python, Go, and query languages (e.g., KQL, SQL).
• Strong self-motivation and ability to independently drive complex research projects from concept to delivery.

Preferred Qualifications

• Familiarity with cloud infrastructure (AWS, GCP, Azure), Kubernetes, and modern cloud-native architectures.
• Background in incident response, red teaming, or threat hunting.
• Hands-on experience building and shipping security detections as part of a product.
• Experience writing technical blogs, publishing security research, or speaking at industry conferences.
• Leveraging AI/LLM-driven tools to enhance detection generation and telemetry analysis.
• Clear and effective communicator with excellent collaboration skills, comfortable working across teams and disciplines.

About the job

We're looking for a Threat Detection Researcher to join the Threat Research team and spread the power of Wiz. In this role, you will further develop the Cloud-native Threat Detection domain.

Check out some of our recent research:

• Detecting Malicious OAuth Applications

• Tracking TeamPCP: Investigating Post-Compromise Attacks Seen in the Wild

• Wiz Discovers Cloud Email Abuse Campaign

Responsibilities

• Drive the full lifecycle of security detections - from threat research and data analysis to building and shipping detection logic directly into production.
• Design behavioral baselines for complex cloud environments using diverse signals, and develop high-fidelity detections based on those baselines.
• Expand Wiz's detection engine with novel and high-impact telemetry sources, pushing the boundaries of what can be detected in modern cloud environments.
• Conduct deep technical research into complex cloud services to uncover novel attack vectors.
• Investigate real-world attacks across cloud environments, identity providers (IDPs), and infrastructure-as-a-service (IaaS) platforms.
• Hunt and analyze emerging threats and active campaigns targeting the cloud ecosystem.