<p>Our Security team keeps Asana's employees, users, and customers safe by proactively addressing threats and fostering a culture of security across our product and operations.</p> <p>We're looking for a Staff Detection Engineer to join our Threat Response team in our Warsaw innovation hub. You'll own how we find threats: the detection logic, the telemetry it runs on, and the pipeline that ships it. <strong>Detection here is software.</strong> Rules are written as code, tested against real and synthetic attacker behavior, reviewed in pull requests, and deployed through CI/CD. You'll partner with our incident responders, infrastructure, and product teams to make sure that when something bad happens, we see it fast and with high signal.</p> <p>We offer a Contract of Employment (UoP) for our employees in Poland.</p> <h3>What you'll achieve</h3> <ul> <li><strong>Design, build, and maintain high-fidelity detections</strong> across cloud infrastructure (AWS/GCP), identity providers (e.g., Okta), SaaS environments, endpoints, and the software supply chain.</li> <li><strong>Own our detection-as-code pipeline</strong> in Panther: rule structure, unit and integration tests, review standards, and CI/CD deployment, so detection logic is treated as production code.</li> <li><strong>Map and close coverage gaps</strong> against MITRE ATT&CK and the threat model for our environment, prioritizing the techniques most likely to be used against a SaaS company.</li> <li><strong>Onboard and normalize new telemetry sources</strong>, working with infrastructure and IT to make sure the right logs exist, are complete, and are queryable.</li> <li><strong>Measure and improve alert quality</strong>, tracking precision, time-to-triage, and false-positive rates, and tuning or retiring detections that don't earn their keep.</li> <li><strong>Validate detections against real attacker behavior</strong> through purple-team exercises, atomic tests, and emulation, and feed findings back into rule development.</li> <li><strong>Turn incidents and threat intelligence into detections</strong>, partnering with incident responders to convert lessons learned and emerging TTPs into durable coverage.</li> <li><strong>Build enrichment and automation</strong> in our SOAR platform so alerts arrive with the context responders need to act.</li> </ul> <h3>About you</h3> <ul> <li><strong>8+ years in detection engineering, security operations, or threat hunting</strong>, with a track record of building detections that responders actually trust.</li> <li><strong>Strong Python skills</strong>, with hands-on experience in Git workflows, PR-based code review, automated testing, and CI/CD. Go, Bash, or JavaScript/TypeScript is a plus.</li> <li><strong>Deep experience with detection-as-code</strong>, including test-driven detection logic, rule lifecycle management, and deploying rules through CI/CD pipelines.</li> <li><strong>Strong experience with SIEM platforms</strong> (e.g., Panther, Splunk, Elastic Security), including query languages, log schemas, and correlation.</li> <li><strong>Deep understanding of cloud and identity telemetry</strong>, such as AWS, GCP audit logs, Okta system logs, and SaaS audit APIs, and what attacker activity looks like in each.</li> <li><strong>Working knowledge of EDR tools</strong> (e.g., CrowdStrike, SentinelOne) and endpoint telemetry (MacOS).</li> <li><strong>Fluency with attacker TTPs</strong> and MITRE ATT&CK, and experience using it to drive coverage decisions rather than as a checklist.</li> <li><strong>Collaborative and pragmatic mindset</strong>, with strong communication across technical and non-technical partners, and an instinct for reducing noise rather than adding to it.</li> <li><strong>Demonstrated curiosity about AI tools</strong> and emerging technologies, with willingness to learn and leverage them to enhance productivity, collaboration, or decision-making.</li> </ul> <h3>Nice to have</h3> <ul> <li><strong>Experience detecting software supply chain and CI/CD threats</strong>, including anomalous behavior in build systems and developer ecosystems (e.g., npm, PyPI, GitHub Actions).</li> <li><strong>Experience with adversary emulation frameworks</strong> (e.g., Atomic Red Team, Caldera) or running purple-team exercises.</li> <li><strong>Experience with data engineering for security</strong>, such as log pipelines, schema design, or cost optimization for high-volume telemetry.<br><br><br></li> </ul> <h3>What we offer </h3> <ul> <li>Generous, transparent and fair compensation system (base salary and RSUs).</li> <li>Contract of Employment (and the option of 50% tax deductible costs for author’s rights usage in respect of applicable roles).</li> <li>Health insurance with dental and travel coverage (Lux Med).</li> <li>Breakfast and lunch catering on the days that you work from the office.</li> <li>Vacation allowance.</li> <li>Career growth budget.</li> <li>Home office setup budget.</li> <li>Gym/Fitness card.</li> <li>Fertility healthcare and family-forming support with Carrot.</li> <li>Mental Health Support in Modern Health.</li> <li>Group life insurance.</li> <li>MacBooks with all necessary accessories</li> </ul>