Senior Threat Research Engineer – Taiwan
Obsidian Security2 months ago
Taipei, TaiwanSenior
Responsibilities
- Establish the Taiwan detection engineering function, including technical direction, operating model, quality standards, and hiring plan.
- Research cloud, identity, and SaaS threats and translate attacker behavior into actionable detection opportunities and threat models.
- Design, author, test, maintain, and tune detection rules and behavioral detection models.
- Define telemetry, enrichment, correlation, and historical context requirements for effective detections.
- Partner with platform and data engineering teams to build scalable detection capabilities and production processing pipelines.
- Develop frameworks for detection testing, simulation, coverage measurement, versioning, release management, and tuning.
- Measure and improve detection precision, recall, explainability, performance, and customer value.
- Investigate false positives and false negatives, identify root causes, and improve detection logic and data quality.
- Map detection coverage to threat frameworks, attack techniques, product use cases, and customer risks.
- Document detection intent, evidence, expected behavior, limitations, and recommended response actions.
- Collaborate with Security Research, Product Management, platform engineering, data engineering, Customer Success, and global teams across Taiwan, the US, the UK, and Australia.
Requirements
- Significant experience in detection engineering, threat research, security analytics, incident response, threat hunting, or a closely related security discipline.
- Experience leading security research or detection initiatives and mentoring other practitioners.
- Strong knowledge of attacker behavior, identity threats, cloud security, and modern enterprise SaaS environments.
- Demonstrated experience developing production detections using rules, queries, correlations, statistical methods, or behavioral models.
- Experience working with large security datasets such as audit events, authentication activity, identity data, application logs, or cloud telemetry.
- Strong data analysis skills and proficiency with relevant query, scripting, or programming languages.
- Understanding of detection lifecycle management, including research, development, validation, deployment, monitoring, tuning, and retirement.
- Experience measuring detection quality and using production feedback to improve security outcomes.
- Ability to communicate technical security concepts clearly to engineering, product, customer-facing, and executive audiences.
- Strong written and verbal communication skills in English and the ability to collaborate across regions, time zones, functions, and cultures.
- Preferred experience with identity security, SaaS security, cloud detection and response, SIEM, UEBA, EDR, XDR, MITRE ATT&CK, detection-as-code, machine learning, generative AI, real-world intrusions, incident response teams, or globally distributed APAC teams.
- Mandarin proficiency is a preferred qualification.
Tech Stack
DatabricksGoogle Cloud
Categories
About Obsidian Security
Obsidian Security builds a SaaS security platform for enterprises to discover and govern third-party app and AI integrations, manage OAuth/API permissions, and detect and respond to identity and SaaS threats. It sells subscriptions to large regulated organizations; named customers include Snowflake, T-Mobile, and Algolia. Founded in 2017 and headquartered in Palo Alto, the privately held company focuses on Microsoft 365, Salesforce, and other major business apps.