About the Job
Our Security team keeps Asana's employees, users, and customers safe by proactively addressing threats and fostering a culture of security across our product and operations.
We're looking for a Staff Detection Engineer to join our Threat Response team in our Warsaw innovation hub. You'll own how we find threats: the detection logic, the telemetry it runs on, and the pipeline that ships it. Detection here is software. Rules are written as code, tested against real and synthetic attacker ...
We offer a Contract of Employment (UoP) for our employees in Poland.
Required Skills & Abilities
8+ years in detection engineering, security operations, or threat hunting, with a track record of building detections that responders actually trust.
Strong Python skills, with hands-on experience in Git workflows, PR-based code review, automated testing, and CI/CD. Go, Bash, or JavaScript/TypeScript is a plus.
Deep experience with detection-as-code, including test-driven detection logic, rule lifecycle management, and deploying rules through CI/CD pipelines.
Strong experience with SIEM platforms (e.g., Panther, Splunk, Elastic Security), including query languages, log schemas, and correlation.
Deep understanding of cloud and identity telemetry, such as AWS, GCP audit logs, Okta system logs, and SaaS audit APIs, and what attacker activity looks like in each.
Working knowledge of EDR tools (e.g., CrowdStrike, SentinelOne) and endpoint telemetry.
Fluency with attacker TTPs and MITRE ATT&CK, and experience using it to drive coverage decisions rather than as a checklist.
Collaborative and pragmatic mindset, with strong communication across technical and non-technical partners, and an instinct for reducing noise rather than adding to it.
Demonstrated curiosity about AI tools and emerging technologies, with willingness to learn and leverage them to enhance productivity, collaboration, or decision-making.
Experience detecting software supply chain and CI/CD threats, including anomalous behavior in build systems and developer ecosystems (e.g., npm, PyPI, GitHub Actions).
Experience with adversary emulation frameworks (e.g., Atomic Red Team, Caldera) or running purple-team exercises.
Experience with data engineering for security, such as log pipelines, schema design, or cost optimization for high-volume telemetry.
