Note: The job is a remote job and is open to candidates in USA. Snowflake is a rapidly growing company focused on powering the era of the agentic enterprise. They are hiring a Staff Security Engineer, Threat Detection to enhance their AI-powered threat detection and response capabilities, combining deep security expertise with strong engineering skills to build and maintain detection systems.
Responsibilities
- Develop and deploy detections using modern engineering practices (testing and validation, CI/CD pipelines, detections as code, and a full detection development lifecycle), spanning both rules-based and AI-assisted detections
- Mature our threat detection program by analyzing coverage gaps and mitigating risks through detective controls, experimenting with AI/ML approaches where they improve signal-to-noise ratio or analyst efficiency
- Make data-driven recommendations for detective and preventative controls based on threat models, proactive threat hunts, and data science-oriented exploration of logs and telemetry
- Design and build automations and AI-driven workflows that strengthen our security posture and reduce mean time to detect and respond
- Build and maintain strong partnerships with stakeholders to deliver detection as a service, including self-service patterns, reusable components, and AI-enhanced detections that support their domains
- Continuously measure and improve detection quality across coverage, precision and recall, false positive rate, and latency
Skills
- 8+ years of security engineering experience across one or more of threat detection, incident response, threat hunting, product security, or corporate security, or equivalent experience
- Strong coding ability in a high-level language such as Python or Go, with a track record of building software, data tooling, or automations, and a desire to apply those skills to AI/ML-powered detection and response
- Experience handling data programmatically (SQL, Python), ideally including large-scale log and telemetry datasets used for detection logic or analytics
- Experience writing production code, including unit tests, version control, and CI/CD integration
- Experience developing and operating agent-based or agentic workflows (for example, LangGraph or similar orchestration frameworks)
- Hands-on experience with at least one major cloud provider (AWS, Azure, or GCP) and a solid understanding of its native logging, monitoring, and security services
- Familiarity with the risks that impact SaaS products and workstations, such as account compromise, data exfiltration, phishing, and supply chain attacks
- A risk-based approach that helps prioritize key security initiatives and judge when AI provides meaningful value over traditional rules and heuristics, paired with a humble, team-oriented mindset in a zero-ego environment
- Computer Science degree or equivalent practical experience
- Experience applying GenAI and LLM-based approaches to security workflows, such as detection engineering, alert triage, enrichment, or summarization
- Experience with infrastructure as code (Terraform, CloudFormation) and/or detections-as-code frameworks
- Experience building and maintaining production software or platforms that process high-volume data streams (logs, metrics, traces) or power security analytics
- Experience deploying detections at global scale
- Experience with Snowflake or equivalent cloud data platforms, including building data pipelines or analytics that support security workloads, and interest in Snowflake Cortex AI or similar in-platform AI capabilities
Company Overview