Security Researcher Remote; EU

Weve is building workplace security for a world where people and AI agents work across dozens of systems. We connect activity, identity and business context so security teams can investigate risks that no single tool can explain on its own.

A large download, a new source IP or an AI tool touching an unfamiliar repository can be legitimate work. It can also be the start of an incident. We’re looking for a researcher who can turn that ambiguity into precise hypotheses, useful detections and investigations that test competing explanations.

Your work will span workplace applications, identity, cloud activity and AI usage. You’ll partner with engineering to make research operational: define the observable behaviour, identify the data required and establish how we know a detection is useful.

• Research misuse of legitimate access, risky sharing, unusual agent activity and related workplace threats using authorised environments and evidence.
• Specify the signals, relationships, history and peer context needed to distinguish a credible risk from normal work.
• Develop investigation approaches that seek both supporting evidence and benign explanations, with clear limits on what can be concluded.
• Build representative evaluation cases, including near misses, incomplete telemetry and legitimate behaviour that resembles an attack.
• Work with applied AI and engineering to turn research into maintained detections, investigation tools and measurable evaluation criteria.
• Review customer findings with field engineering and use disagreements, false positives and missed context to improve the system.

• Hands-on experience in detection engineering, incident response, threat research or a closely related security discipline.
• The ability to reconstruct activity from audit logs and explain what those logs do and do not establish.
• Practical scripting and data-analysis skills to explore behaviour, test hypotheses and create repeatable research.
• Good judgement about evidence, privacy and authorisation, especially when investigating employee activity.
• Clear writing: you can explain a detection’s assumptions, likely failure modes and validation approach to another engineer.

Identity and SaaS security, behavioural detection, insider risk, agent tool use or evaluation of AI-generated investigations.

• Research produces detections with explicit data requirements and understandable failure modes.
• Evaluation includes legitimate lookalikes, so improvements reflect better judgement rather than more alerts.
• Investigations leave a reviewer able to understand the evidence, uncertainty and reason for escalation.

You’ll work directly with the people building and selling Weve. We expect you to question the brief, make decisions within your area and follow through after something ships. Customer evidence matters more than how convincing an idea sounds in a meeting.

We work remotely and write down our decisions so people can make progress without waiting for everyone to be online. Read more about the team and why we’re building Weve .