SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 139,200 - 190,000 / annual
GitLab is seeking a Senior Security Detection Engineer to join the Detection Engineering team, responsible for building and maintaining a best-in-class detection engineering program. You will focus on writing threat detections, hunting for patterns of behavioral anomalies across GitLab corporate, cloud, and customer environments, and closing detection gaps. The team emphasizes automation, LLM-aided efficiencies, and behavior-focused detection over atomic indicators.
In this role, you will identify MITRE ATT&CK and top threat actor detection gaps and write behavioral detections to close them. You'll serve as a detection subject matter expert, deeply understanding GitLab's detection methodology, Detection-as-Code (DaC) framework, detection types, and quality thresholds. You'll act as a "detection architect," orchestrating agents across the entire detection lifecycle to ensure detection quality and consistency.
Key responsibilities include using SIEM/data lake platforms like Splunk or Elastic to write and troubleshoot threat detections, collaborating with peer GitLab teams to identify security observability improvements, and working cross-functionally with incident response, red teams, and threat intelligence to improve GitLab's detection program and coverage. You'll also use, maintain, and build new DaC, AI, and process efficiency automations for the signals engineering program.
The Detection Engineering team works closely with Security Operations to simulate attack patterns, respond to incidents, and consume threat intelligence. Part of this role focuses on customer threat detection—turning GitLab threat insights into actionable customer alerts.
REQUIREMENTS:
- SOC, incident response, or detection engineering expertise
- SIEM/security data lake detection and query expertise
- Proven ability to proactively detect potentially malicious patterns and collaborate with incident response to complete incident RCAs and identify new detection opportunities
- Strong Cloud (AWS/GCP) and some PaaS (Kubernetes/Terraform) experience
- Experience orchestrating teams of agents to write detections; bonus for building full end-to-end agentic detection pipelines
- Experience with mature detection capabilities such as Detections as Code, signal vs. detection development, risk-based alerting, and behavior analytics
- Understanding of the GitLab application; bonus if comfortable detecting and hunting attacks against GitLab or if you've maintained GitLab yourself
- Passion for deep-dive threat hunting and cross-functional purple teaming, turning results into detections
- Must be a United States Citizen (defined as any individual who is a citizen of the United States by law, birth, or naturalization)
