# Staff Detection Engineer at Asana

- Company: Asana (asana.com)
- Location: Warsaw
- Places: Warsaw
- Posted: 2025-10-23
- Apply: https://www.asana.com/jobs/apply/7350641?gh_jid=7350641
- Page: https://ye.saranatour.dev/jobs/staff-detection-engineer-asana-kn7dk8txfbjmzrrbf2tvvqp7n98hj0tb

## The posting

Staff Detection Engineer
Asana · Warsaw

Our Security team keeps Asana's employees, users, and customers safe by proactively addressing threats and fostering a culture of security across our product and operations.

We're looking for a Staff Detection Engineer to join our Threat Response team in our Warsaw innovation hub. You'll own how we find threats: the detection logic, the telemetry it runs on, and the pipeline that ships it. **Detection here is software.** Rules are written as code, tested against real and synthetic attacker behavior, reviewed in pull requests, and deployed through CI/CD. You'll partner with our incident responders, infrastructure, and product teams to make sure that when something bad happens, we see it fast and with high signal.

We offer a Contract of Employment (UoP) for our employees in Poland.

### What you'll achieve

- **Design, build, and maintain high-fidelity detections** across cloud infrastructure (AWS/GCP), identity providers (e.g., Okta), SaaS environments, endpoints, and the software supply chain.
- **Own our detection-as-code pipeline** in Panther: rule structure, unit and integration tests, review standards, and CI/CD deployment, so detection logic is treated as production code.
- **Map and close coverage gaps** against MITRE ATT&CK and the threat model for our environment, prioritizing the techniques most likely to be used against a SaaS company.
- **Onboard and normalize new telemetry sources**, working with infrastructure and IT to make sure the right logs exist, are complete, and are queryable.
- **Measure and improve alert quality**, tracking precision, time-to-triage, and false-positive rates, and tuning or retiring detections that don't earn their keep.
- **Validate detections against real attacker behavior** through purple-team exercises, atomic tests, and emulation, and feed findings back into rule development.
- **Turn incidents and threat intelligence into detections**, partnering with incident responders to convert lessons learned and emerging TTPs into durable coverage.
- **Build enrichment and automation** in our SOAR platform so alerts arrive with the context responders need to act.

### About you

- **8+ years in detection engineering, security operations, or threat hunting**, with a track record of building detections that responders actually trust.
- **Strong Python skills**, with hands-on experience in Git workflows, PR-based code review, automated testing, and CI/CD. Go, Bash, or JavaScript/TypeScript is a plus.
- **Deep experience with detection-as-code**, including test-driven detection logic, rule lifecycle management, and deploying rules through CI/CD pipelines.
- **Strong experience with SIEM platforms** (e.g., Panther, Splunk, Elastic Security), including query languages, log schemas, and correlation.
- **Deep understanding of cloud and identity telemetry**, such as AWS, GCP audit logs, Okta system logs, and SaaS audit APIs, and what attacker activity looks like in each.
- **Working knowledge of EDR tools** (e.g., CrowdStrike, SentinelOne) and endpoint telemetry (MacOS).
- **Fluency with attacker TTPs** and MITRE ATT&CK, and experience using it to drive coverage decisions rather than as a checklist.
- **Collaborative and pragmatic mindset**, with strong communication across technical and non-technical partners, and an instinct for reducing noise rather than adding to it.
- **Demonstrated curiosity about AI tools** and emerging technologies, with willingness to learn and