At a glance
- Workplace
- Remote
- Location
- Remote
- Salary
- USD 139,200-190,000 · Base salary
About the role
- You will join the growing Detection Engineering team at GitLab, responsible for building and maintaining a best-in-class detection engineering program.
- If you love writing threat detections, hunting for patterns of behavioral anomalies across corporate, cloud, and customer environments as well as closing detection gaps, this team is for you.
Responsibilities
- Identify MITRE ATT&CK/top threat actor detection gaps and write behavioral detections to close them.
- Be a detection SME and deeply understand GitLab’s detection methodology, DaC framework, detection types, and quality thresholds.
- Act as a “detection architect” - orchestrating agents across the entire detection lifecycle and ensuring detection quality and consistency.
- Use a SIEM/data lake platform like Splunk or Elastic to write and troubleshoot threat detections.
- Collaborate with peer GitLab teams to identify and close security observability improvement opportunities.
- Collaborate with incident response, red team, as well as threat intelligence to cross functionally improve GitLab’s detection program and coverage.
- Use, maintain, and build new DaC, AI, and process efficiency automations for the signals engineering program.
Requirements
- SOC, incident response or detection engineering expertise.
- SIEM/security data lake detection and query expertise.
- A proven ability to proactively detect potentially malicious patterns and collaborate with incident response to complete incident RCAs to identify and implement new detection opportunities.
- Strong Cloud (AWS/GCP) and some PaaS (Kubernetes/terraform) experience.
- Experience orchestrating teams of agents to write detections.
- Bring a passion for deep dive threat hunting and cross functional purple teaming and turning results into detections.
- Experience with mature detection capabilities such as: Detections as Code, Signal vs detection development, risk based alerting, and behavior analytics.
- Due to government requirements, you must be a United States Citizen (defined as any individual who is a citizen of the United States by law, birth, or naturalization) to fill this position.
Preferred qualifications
- Bonus points if you are experienced in writing SaaS application detections, double bonus points if that application is GitLab.
- An understanding of the GitLab application, bonus points if you are comfortable detecting and hunting for attacks against GitLab or if you’ve maintained GitLab yourself.
- Bonus points for experience building full end to end agentic detection pipelines.
Benefits
- Benefits to support your health, finances, and well-being
- Flexible Paid Time Off
- Team Member Resource Groups
- Equity Compensation & Employee Stock Purchase Plan
- Growth and Development Fund
- Parental Leave
Workplace
- All of our roles are remote, however some roles may carry specific location-based eligibility requirements.
Skills
- Splunk
- Elastic
- AWS
- GCP
- Kubernetes
- Terraform
- GitLab CI/CD
