3 hours ago
Remote, United StatesSenior
Base Salary
$139k - $190k/yr
Responsibilities
- Identify MITRE ATT&CK and top-threat-actor detection gaps and write behavioral detections to address them.
- Serve as a detection subject matter expert and architect across GitLab’s detection lifecycle, methodology, frameworks, detection types, and quality thresholds.
- Write and troubleshoot threat detections using SIEM or security data lake platforms such as Splunk or Elastic.
- Orchestrate agents and build, maintain, and improve agentic AI, detection-as-code, and process-efficiency automations.
- Collaborate with security operations, incident response, red team, threat intelligence, and engineering teams to improve detection coverage and security observability.
- Develop customer threat detections that turn GitLab threat insights into actionable alerts.
Requirements
- Experience in SOC, incident response, or detection engineering.
- Expertise with SIEM or security data lake detection and query development.
- Ability to proactively detect malicious patterns, support incident root-cause analyses, and implement resulting detection opportunities.
- Strong cloud experience with AWS or GCP and some PaaS experience with Kubernetes or Terraform.
- Experience orchestrating teams of agents to write detections; end-to-end agentic detection pipeline experience is preferred.
- Experience with threat hunting, purple teaming, and mature capabilities such as Detection as Code, signal versus detection development, risk-based alerting, and behavior analytics.
- Understanding of the GitLab application or experience detecting and hunting attacks against GitLab is preferred.
- United States citizenship is required due to government requirements.
Benefits
- Benefits supporting health, finances, and well-being.
- Flexible paid time off.
- Team Member Resource Groups.
- Equity compensation and Employee Stock Purchase Plan.
- Growth and Development Fund.
- Parental leave.
- Remote work; location-based eligibility requirements may apply.
- The role is listed for US residents and requires US citizenship.
Tech Stack
Categories
About GitLab
GitLab builds a DevSecOps platform that unifies source code management, CI/CD, and security with AI-assisted workflows for software teams and enterprises. It sells cloud-hosted and self-managed subscriptions, plus enterprise features and support. Founded in 2014 and headquartered in San Francisco, GitLab is a public company listed on NASDAQ and is widely used by large enterprises, including many in the Fortune 100.