Staff Detection Engineer

Asana is seeking a Staff Detection Engineer to join their Threat Response team based in their Warsaw innovation hub. The team focuses on proactive threat detection and security across the Asana product and operations in a SaaS environment.

• 8+ years in detection engineering, security operations, or threat hunting with proven experience in reliable detection creation.
• Strong Python skills with experience in Git workflows, PR-based code review, automated testing, and CI/CD.
• Deep experience with detection-as-code, including test-driven detection logic and rule lifecycle management.
• Strong experience with SIEM platforms such as Splunk, Panther, Elastic Security, including query languages and log correlation.
• Deep understanding of cloud and identity telemetry: AWS, GCP audit logs, Okta logs, and SaaS audit APIs.
• Working knowledge of EDR tools (e.g., CrowdStrike, SentinelOne) and endpoint telemetry (MacOS).
• Familiarity with attacker TTPs, MITRE ATT&CK framework, and practical application to coverage decisions.
• Collaborative communication skills across technical and non-technical partners.
• Curiosity and willingness to leverage AI tools and emerging technologies.

Nice to have:

• Experience detecting software supply chain and CI/CD threats, including ecosystems like npm, PyPI, GitHub Actions.
• Experience with adversary emulation frameworks (Atomic Red Team, Caldera) or purple-team exercises.
• Experience with data engineering for security such as log pipelines, schema design, or cost optimization for high-volume telemetry.

• Design, build, and maintain high-fidelity detections across cloud infrastructure (AWS, GCP), identity providers (e.g., Okta), SaaS environments, endpoints, and the software supply chain.
• Own the detection-as-code pipeline in Panther: rule structure, unit and integration tests, review standards, and CI/CD deployment.
• Map and close coverage gaps against MITRE ATT&CK and the threat model relevant to the SaaS environment.
• Onboard and normalize new telemetry sources, coordinating with infrastructure and IT.
• Measure and improve alert quality, including precision, time-to-triage, and false-positive rates.
• Validate detections against attacker behavior through purple-team exercises, atomic tests, and emulation.
• Convert incidents and threat intelligence into detections by partnering with incident responders.
• Build enrichment and automation in the SOAR platform to provide contextual alerts for responders.