Senior Security Detection Engineer

. Identify MITRE ATT&CK/top threat actor detection gaps and write behavioral detections to close them .

Posted 10/7/2026full-timeRemote • United StatesSenior💰 $139,200 - $190,000 per yearWebsite

Tools & technologies

AWSCloudDACGoogle Cloud PlatformKubernetesSplunkTerraform

Key responsibilities & impact

Identify MITRE ATT&CK/top threat actor detection gaps and write behavioral detections to close them
Serve as a detection subject matter expert with deep knowledge of GitLab’s detection methodology, DaC framework, detection types, and quality thresholds
Orchestrate agents across the detection lifecycle as a detection architect, ensuring detection quality and consistency
Use SIEM/data lake platforms such as Splunk or Elastic to write and troubleshoot threat detections
Collaborate with peer GitLab teams to identify and close security observability improvement opportunities
Collaborate with incident response, red team, and threat intelligence teams to improve GitLab’s detection program and coverage
Use, maintain, and build DaC, AI, and process-efficiency automations for the signals engineering program
Detect suspicious and malicious events for GitLab, its customers, and SaaS operating environments

What you’ll need

SOC, incident response or detection engineering expertise
SIEM/security data lake detection and query expertise
Proven ability to proactively detect potentially malicious patterns and collaborate with incident response to complete incident RCAs and identify and implement new detection opportunities
Strong Cloud (AWS/GCP) and some PaaS (Kubernetes/Terraform) experience
Experience orchestrating teams of agents to write detections; experience building full end-to-end agentic detection pipelines is a bonus
Passion for deep-dive threat hunting and cross-functional purple teaming and turning results into detections
Experience with mature detection capabilities such as Detections as Code, Signal vs. detection development, risk-based alerting, and behavior analytics
Must be a United States Citizen
Understanding of the GitLab application is required; experience detecting and hunting attacks against GitLab or maintaining GitLab is a bonus

Comp & perks