Staff Detection Engineer Warsaw

Asana, Inc.; Warszawa; On-site; PLN 446,000 - 502,000; Full time

Benefits offered by this job

Health insurance

Home office setup budget

Gym/Fitness card

Breakfast and lunch catering

Career growth budget

MacBooks with accessories

Job summary

Asana, Inc. in Warsaw is seeking a Staff Detection Engineer to own how we find threats—detection logic, telemetry, and the pipeline that ships it—within our Threat Response team.

You will work with incident responders, infra, and product teams to ensure rapid, high-signal detection in a SaaS environment. You will design, build, and maintain detections across cloud, identity, and endpoints, and drive detection-as-code through CI/CD.

Qualifications

• 8+ years in detection engineering, security operations, or threat hunting.
• Strong Python skills with Git workflows, PR reviews, tests, and CI/CD.
• Deep experience with detection-as-code, including rule lifecycle and CI/CD deployment.
• Strong experience with SIEM platforms (Panther, Splunk, Elastic).
• Deep understanding of cloud and identity telemetry (AWS, GCP, Okta).
• Working knowledge of EDR tools (CrowdStrike, SentinelOne) and endpoint telemetry.
• Fluency with attacker TTPs and MITRE ATT&CK to drive coverage decisions.
• Collaborative mindset with clear communication across technical/non‑technical partners.

Responsibilities

• Design, build, and maintain high-fidelity detections across cloud, identity, SaaS, endpoints, and software supply chain.
• Own the detection-as-code pipeline in Panther including tests and CI/CD deployment.
• Map and close coverage gaps against MITRE ATT&CK for our environment.
• Onboard and normalize new telemetry sources with IT/infrastructure.
• Measure and improve alert quality and reduce noise.
• Validate detections with purple-team exercises and emulation, feed findings to rule development.
• Turn incidents and threat intelligence into durable coverage through detections.
• Build enrichment and automation in the SOAR platform to provide actionable context.

Skills

Detection engineering

Python

CI/CD

SIEM (Panther)

MITRE ATT&CK

Cloud telemetry

EDR tools

Threat hunting

AI tooling curiosity

Tools

Panther

Splunk

Elastic Security

Okta

CrowdStrike

SentinelOne

AWS

GCP

Job description

Our Security team keeps Asana's employees, users, and customers safe by proactively addressing threats and fostering a culture of security across our product and operations.

We're looking for a Staff Detection Engineer to join our Threat Response team in our Warsaw innovation hub. You'll own how we find threats: the detection logic, the telemetry it runs on, and the pipeline that ships it. Detection here is software. Rules are written as code, tested against real and synthetic attacker behavior, reviewed in pull requests, and deployed through CI/CD. You'll partner with our incident responders, infrastructure, and product teams to make sure that when something bad happens, we see it fast and with high signal.

We offer a Contract of Employment (UoP) for our employees in Poland.

What you'll achieve

• Design, build, and maintain high-fidelity detections across cloud infrastructure (AWS/GCP), identity providers (e.g., Okta), SaaS environments, endpoints, and the software supply chain.
• Own our detection-as-code pipeline in Panther: rule structure, unit and integration tests, review standards, and CI/CD deployment, so detection logic is treated as production code.
• Map and close coverage gaps against MITRE ATT&CK and the threat model for our environment, prioritizing the techniques most likely to be used against a SaaS company.
• Onboard and normalize new telemetry sources, working with infrastructure and IT to make sure the right logs exist, are complete, and are queryable.
• Measure and improve alert quality, tracking precision, time-to-triage, and false-positive rates, and tuning or retiring detections that don't earn their keep.
• Validate detections against real attacker behavior through purple-team exercises, atomic tests, and emulation, and feed findings back into rule development.
• Turn incidents and threat intelligence into detections, partnering with incident responders to convert lessons learned and emerging TTPs into durable coverage.
• Build enrichment and automation in our SOAR platform so alerts arrive with the context responders need to act.

About you

• 8+ years in detection engineering, security operations, or threat hunting, with a track record of building detections that responders actually trust.
• Strong Python skills, with hands‑on experience in Git workflows, PR‑based code review, automated testing, and CI/CD. Go, Bash, or JavaScript/TypeScript is a plus.
• Deep experience with detection-as-code, including test‑driven detection logic, rule lifecycle management, and deploying rules through CI/CD pipelines.
• Strong experience with SIEM platforms (e.g., Panther, Splunk, Elastic Security), including query languages, log schemas, and correlation.
• Deep understanding of cloud and identity telemetry, such as AWS, GCP audit logs, Okta system logs, and SaaS audit APIs, and what attacker activity looks like in each.
• Working knowledge of EDR tools (e.g., CrowdStrike, SentinelOne) and endpoint telemetry.
• Fluency with attacker TTPs and MITRE ATT&CK, and experience using it to drive coverage decisions rather than as a checklist.
• Collaborative and pragmatic mindset, with strong communication across technical and non‑technical partners, and an instinct for reducing noise rather than adding to it.
• Demonstrated curiosity about AI tools and emerging technologies, with willingness to learn and leverage them to enhance productivity, collaboration, or decision‑making.

Nice to have

• Experience detecting software supply chain and CI/CD threats, including anomalous behavior in build systems and developer ecosystems (e.g., npm, PyPI, GitHub Actions).
• Experience with adversary emulation frameworks (e.g., Atomic Red Team, Caldera) or running purple‑team exercises.
• Experience with data engineering for security, such as log pipelines, schema design, or cost optimization for high‑volume telemetry.

What we offer

• Generous, transparent and fair compensation system (base salary and RSUs).
• Contract of Employment (and the option of 50% tax deductible costs for author’s rights usage in respect ofapplicable roles).
• Health insurance with dental and travel coverage (Lux Med).
• Breakfast and lunch catering on the days that you work from the office.
• Vacation allowance.
• Career growth budget.
• Home office setup budget.
• Gym/Fitness card.
• Fertility healthcare and family‑forming support with Carrot.
• Mental Health Support in Modern Health.
• Group life insurance.
• MacBooks with all necessary accessories

For this role, the estimated base salary range is between 40 000 - 45 000 PLN gross per month (subject to all taxes and necessary deductions). The actual base salary will vary based on various factors, including market and individual qualifications objectively assessed during the interview process. The listed range above is a guideline, and the base salary range for this role may be modified. In addition to base salary, your compensation package may include additional components such as equity and sales incentive pay (for most sales roles), and benefits. If you're interviewing for this role, speak with your recruiter to learn more about the total compensation and benefitsfor this role.

#LI-Hybrid

About us

Asana is a leading platform for human + AI collaboration. Millions of teams around the world rely on Asana to achieve their most important goals, faster. Asana has been named to Fortune's Best Workplaces for 7+ years and recognized by Fast Company, Forbes, and Gartner for excellence in workplace culture and innovation. We offer an exceptional office‑centric culture while adopting the best elements of hybrid models to ensure that every one of our global team members can work together effortlessly. With 13+ offices all over the world, we are always looking for individuals who care about building technology that drives positive change in the world and a culture where everyone feels that they belong.

We believe in supporting people to do their best work and thrive. Our goal is to ensure that Asana upholds an environment where all people feel that they are respected and valued, whether they are applying for an open position or working at the company. We provide equal employment opportunities to all applicants without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by law.

Join Asana’s Talent Network