Senior Threat Research Engineer – Taiwan

The role

You will lead the development of security detections to identify identity threats and malicious activity across cloud and SaaS environments. You will research threats, develop threat models, and author detection rules while collaborating with global teams.

What you will do

• Work within the detection engineering function in Taiwan including technical direction and hiring.
• Research cloud, identity, and SaaS threats to translate behaviors into detection opportunities.
• Develop threat models covering attack paths, adversary techniques, and identity misuse.
• Design, author, test, and maintain detection rules and behavioral detection models.
• Define telemetry, enrichment, correlation, and historical context for detections.
• Partner with platform and data engineering teams to build scalable detection capabilities.
• Develop frameworks for detection testing, simulation, coverage measurement, and tuning.
• Measure and improve detection precision, recall, explainability, and performance.
• Investigate false positives and false negatives to improve detection logic.
• Map detection coverage to threat frameworks and customer risks.

Required qualifications

• Significant experience in detection engineering, threat research, security analytics, incident response, threat hunting, or a closely related security discipline.
• Experience leading security research or detection initiatives and mentoring other practitioners.
• Strong knowledge of attacker behavior, identity threats, cloud security, and modern enterprise SaaS environments.
• Demonstrated experience developing production detections using rules, queries, correlations, statistical methods, or behavioral models.
• Experience working with large security datasets including audit events, authentication activity, identity data, application logs, or cloud telemetry.
• Ability to distinguish malicious behavior from legitimate activity and translate reasoning into detection logic.
• Strong data analysis skills and proficiency with relevant query, scripting, or programming languages.
• Understanding of detection lifecycle management.
• Experience measuring detection quality and using production feedback.
• Ability to communicate technical security concepts clearly to various audiences.
• Strong written and verbal communication skills in English.
• Ability to collaborate effectively across regions, time zones, functions, and cultures.

Nice to have

• Experience with identity security, SaaS security, cloud detection and response, SIEM, UEBA, EDR, or XDR products.
• Deep familiarity with identity-based attacks, including account takeover, session abuse, privilege escalation, persistence, and lateral movement.
• Experience with MITRE ATT&CK or similar threat-modeling and coverage frameworks.
• Experience building detection-as-code systems, rule languages, detection engines, or automated validation frameworks.
• Experience applying machine learning, anomaly detection, or generative AI to security problems.
• Experience investigating real-world intrusions or working directly with incident response teams.
• Experience building or scaling a detection engineering team.
• Experience working in Taiwan or with globally distributed APAC teams.
• Mandarin proficiency.

About the company

Obsidian Security is a global leader in cyber security protecting the SaaS and non-human identity layer. The platform provides visibility into human and machine identities, apps, and integrations across SaaS estates.