Threat Researcher

The role

You will drive research projects end-to-end to find emerging threats, CVEs and misconfigurations, and assess how exploitable they are in practice. You will also build automations to validate and monitor AI-driven detection capabilities, working closely with Product and R&D teams.

What you will do

• Research emerging threats, CVEs, and misconfigurations to assess real-world exploitability and customer impact.
• Design, build, and test detection rules and scanning logic for exposed and vulnerable assets.
• Build automations to validate, benchmark, and monitor AI-driven detection capabilities at scale.
• Investigate cloud services, frameworks, and commonly deployed technologies to uncover new attack surfaces.
• Analyze large-scale scan results to identify and prioritize meaningful risks.
• Drive research projects end-to-end, from initial idea to production-ready detection.
• Collaborate closely with Product and R&D teams to turn research findings and attack methodologies into product capabilities.

Required qualifications

• 5+ years of hands-on experience in security research, red-teaming, penetration testing, incident response, or vulnerability research.
• Strong understanding of network and application security, including TCP/IP, DNS, TLS, web technologies, modern APIs, and real-world exploitation techniques (e.g., OWASP API Security Top 10).
• Strong scripting and automation skills (Python, Bash, or equivalent).
• Hands-on experience developing, customizing, using, or researching vulnerability scanners (DAST / SAST / Network / Host), writing detection rules, or building automated vulnerability validation tools.
• Strong sense of ownership and ability to independently lead projects from research to delivery.
• Strong writing and presentation skills in both English and Hebrew.

Nice to have

• Experience with cloud environments (AWS, Azure, or GCP).
• Familiarity with security aspects of Kubernetes, containers, and/or CI/CD.
• Familiarity with AI-assisted development tools such as Claude Code or similar.
• Familiarity with network and application scanning tools (Burp Suite, nmap, Metasploit, Nuclei, or similar).
• Published security research, exploits/PoCs, or contributions to open-source security tooling.

Before you apply

• Applicants must have the legal right to work in the country where the position is based.
• This role does not offer visa sponsorship.

About the company

Wiz is a fast-growing security company that secures cloud and AI applications by connecting code, cloud, and runtime into one shared context. It is now powered by Google and is trusted by over 65% of the Fortune 100.