The opportunity
Our Security team keeps Asana's employees, users, and customers safe by proactively addressing threats and fostering a culture of security across our product and operations.
What you'll do
Design, build, and maintain high-fidelity detections across cloud: infrastructure (AWS/GCP), identity providers (e.g., Okta), SaaS environments, endpoints, and the software supply chain.
Own our detection-as-code pipeline in Panther: rule structure, unit and integration tests, review standards, and CI/CD deployment, so detection logic is treated as production code.
Map and close coverage gaps against MITRE ATT&CK and the threat model for our: environment, prioritizing the techniques most likely to be used against a SaaS company.
Onboard and normalize new telemetry sources , working with infrastructure and: IT to make sure the right logs exist, are complete, and are queryable.
Measure and improve alert quality , tracking precision, time-to-triage, and: false-positive rates, and tuning or retiring detections that don't earn their keep.
Validate detections against real attacker behavior through purple-team: exercises, atomic tests, and emulation, and feed findings back into rule development.
What they're looking for
- Turn incidents and threat intelligence into detections , partnering with: incident responders to convert lessons learned and emerging TTPs into durable coverage.
- Build enrichment and automation in our SOAR platform so alerts arrive with the context responders need to act.
- + years in detection engineering, security operations, or threat hunting ,: with a track record of building detections that responders actually trust.
- Strong Python skills , with hands-on experience in Git workflows, PR-based: code review, automated testing, and CI/CD. Go, Bash, or JavaScript/TypeScript is a plus.