Remote Senior Detection Architect: AI-Driven Threat Hunting

Gitlab; United States; Remote; USD 139,000 - 190,000; Full time

Benefits offered by this job

Flexible PTO

Equity

Growth Fund

Parental Leave

Job summary

GitLab is hiring for a Detection Engineer to join the growing Detection Engineering team. You will build and maintain threat detections across GitLab's environments, focusing on automation, AI-assisted efficiencies, and behavior-based detections.

Ideal candidates will have SOC/IR/detection engineering background, experience with SIEMs, and cloud platforms (AWS/GCP). Remote-friendly role with US citizen requirement noted.

Qualifications

• SOC, incident response or detection engineering expertise.
• SIEM/security data lake detection and query expertise.
• Experience orchestrating teams of agents to write detections and collaborate with incident response.

Responsibilities

• Identify MITRE ATT&CK/top threat actor detection gaps and write behavioral detections to close them.
• Be a detection SME and deeply understand GitLab’s detection methodology, DaC framework, detection types, and quality thresholds.
• Act as a detection architect – orchestrating agents across the entire detection lifecycle and ensuring detection quality and consistency.
• Use a SIEM/data lake platform like Splunk or Elastic to write and troubleshoot threat detections.
• Collaborate with peer GitLab teams to identify and close security observability improvement opportunities.
• Collaborate with incident response, red team, as well as threat intelligence to cross functionally improve GitLab’s detection program and coverage.
• Use, maintain, and build new DaC, AI, and process efficiency automations for the signals engineering program.

Skills

SOC

Incident response

Detection engineering

SIEM

Cloud AWS/GCP

Kubernetes/Terraform

Threat hunting

Detections as Code

Tools

Splunk

Elastic

GitLab

Job description

GitLab is hiring for a Detection Engineer to join the growing Detection Engineering team. You will build and maintain threat detections across GitLab's environments, focusing on automation, AI-assisted efficiencies, and behavior-based detections.

Ideal candidates will have SOC/IR/detection engineering background, experience with SIEMs, and cloud platforms (AWS/GCP). Remote-friendly role with US citizen requirement noted.