Identify MITRE ATT&CK and top threat actor detection gaps, then write behavioral detections to close them
Use SIEM or data lake platforms like Splunk or Elastic to write and troubleshoot threat detections
Collaborate with peer GitLab teams to identify and close security observability improvement opportunities
Partner with incident response, red team, and threat intelligence teams to cross-functionally improve GitLab's detection program and coverage
Use, maintain, and build new Detection-as-Code (DaC), AI, and process efficiency automations for the signals engineering program
Requirements
An understanding of the GitLab application (bonus points if you're comfortable detecting and hunting for attacks against GitLab or if you've maintained GitLab yourself)
SOC, incident response, or detection engineering experience
SIEM or security data lake detection and query experience
A proactive approach to detecting potentially malicious patterns and collaborating with incident response to complete incident RCAs and identify new detection opportunities
An interest in cloud technologies such as GKE, AWS, GCP, and other cloud native services (PaaS and SaaS)
An interest in learning how AI can be used for detection engineering
An interest in learning advanced detection capabilities, such as Detection-as-Code, signal vs detection development, risk-based alerting, and behavior analytics
Benefits
Benefits to support your health, finances, and well-being
Flexible Paid Time Off
Team Member Resource Groups
Equity Compensation & Employee Stock Purchase Plan
Growth and Development Fund
Parental leave
Home office support
Applicant Tracking System Keywords
Tip: use these terms in your resume and cover letter to boost ATS matches.