About you
- 8+ years in detection engineering, security operations, or threat hunting , with a track record of building detections that responders actually trust.
- Strong Python skills , with hands-on experience in Git workflows, PR-based code review, automated testing, and CI/CD. Go, Bash, or JavaScript/TypeScript is a plus.
- Deep experience with detection-as-code , including test-driven detection logic, rule lifecycle management, and deploying rules through CI/CD pipelines.
- Strong experience with SIEM platforms (e.g., Panther, Splunk, Elastic Security), including query languages, log schemas, and correlation.
- Deep understanding of cloud and identity telemetry , such as AWS, GCP audit logs, Okta system logs, and SaaS audit APIs, and what attacker activity looks like in each.
- Working knowledge of EDR tools (e.g., CrowdStrike, SentinelOne) and endpoint telemetry (MacOS).
- Fluency with attacker TTPs and MITRE ATT&CK, and experience using it to drive coverage decisions rather than as a checklist.
- Collaborative and pragmatic mindset , with strong communication across technical and non-technical partners, and an instinct for reducing noise rather than adding to it.
- Demonstrated curiosity about AI tools and emerging technologies, with willingness to learn and leverage them to enhance productivity, collaboration, or decision-making.
Nice to have
- Experience detecting software supply chain and CI/CD threats , including anomalous behavior in build systems and developer ecosystems (e.g., npm, PyPI, GitHub Actions).
- Experience with adversary emulation frameworks (e.g., Atomic Red Team, Caldera) or running purple-team exercises.
- Experience with data engineering for security , such as log pipelines, schema design, or cost optimization for high-volume telemetry.
Our Security team keeps Asana's employees, users, and customers safe by proactively addressing threats and fostering a culture of security across our product and operations.
We're looking for a Staff Detection Engineer to join our Threat Response team in our Warsaw innovation hub. You'll own how we find threats: the detection logic, the telemetry it runs on, and the pipeline that ships it. Detection here is software. Rules are written as code, tested against real and synthetic attacker behavior, reviewed in pull requests, and deployed through CI/CD. You'll partner with our incident responders, infrastructure, and product teams to make sure that when something bad happens, we see it fast and with high signal.
We offer a Contract of Employment (UoP) for our employees in Poland.
What we offer
- Generous, transparent and fair compensation system (base salary and RSUs).
- Contract of Employment (and the option of 50% tax deductible costs for author’s rights usage in respect of applicable roles).
- Health insurance with dental and travel coverage (Lux Med).
- Breakfast and lunch catering on the days that you work from the office.
- Vacation allowance.
- Career growth budget.
- Home office setup budget.
- Gym/Fitness card.
- Fertility healthcare and family-forming support with Carrot.
- Mental Health Support in Modern Health.
- Group life insurance.
- MacBooks with all necessary accessories
For this role, the estimated base salary range is between 40 000 - 45 000 PLN gross per month (subject to all taxes and necessary deductions). The actual base salary will vary based on various factors, including market and individual qualifications objectively assessed during the interview process. The listed range above is a guideline, and the base salary range for this role may be modified. In addition to base salary, your compensation package may include additional components such as equity and sales incentive pay (for most sales roles), and benefits. If you're interviewing for this role, speak with your recruiter to learn more about the total compensation and benefits
for this role.
,[Design, build, and maintain high-fidelity detections across cloud infrastructure (AWS/GCP), identity providers (e.g., Okta), SaaS environments, endpoints, and the software supply chain., Own our detection-as-code pipeline in Panther: rule structure, unit and integration tests, review standards, and CI/CD deployment, so detection logic is treated as production code., Map and close coverage gaps against MITRE ATT&CK and the threat model for our environment, prioritizing the techniques most likely to be used against a SaaS company., Onboard and normalize new telemetry sources, working with infrastructure and IT to make sure the right logs exist, are complete, and are queryable., Measure and improve alert quality, tracking precision, time-to-triage, and false-positive rates, and tuning or retiring detections that don't earn their keep., Validate detections against real attacker behavior through purple-team exercises, atomic tests, and emulation, and feed findings back into rule development., Turn incidents and threat intelligence into detections, partnering with incident responders to convert lessons learned and emerging TTPs into durable coverage., Build enrichment and automation in our SOAR platform so alerts arrive with the context responders need to act.] Requirements: Security, Python, Git, Testing, SIEM, CI/CD, Splunk, Cloud, AWS, GCP, Audit, Okta, SaaS, EDR, AI, Bash, JavaScript, TypeScript, npm, GitHub Additionally: Private healthcare, Mental health care, Sport subscription, Training budget, Coaching, Long-term savings or retirement plans, Free coffee, Canteen, Modern office, No dress code, In-house trainings, In-office culinary options, Free lunch, Free snacks, Shower, Bike parking, Free beverages, Free breakfast, Startup atmosphere, In-house hack days.