Staff Software Engineer - Detection Platform (GoLang)

Huntress

3d•$200,000 - $220,000•Remote

About The Position

Huntress is seeking a Staff Software Engineer to join the Detection Platform team. This role is focused on building and rebuilding critical detection systems that power Huntress's cybersecurity offerings. The Detection Platform team is responsible for transforming billions of raw telemetry events into actionable signals for the 24/7 Security Operations Center (SOC). The team's success is measured by time to detection and detection engine uptime. This is a hands-on technical leadership role where the engineer will lead major workstreams, set technical direction, and contribute to production code development. The role involves modernizing detection engines and pipelines, ensuring reliability and predictable behavior under load, and establishing robust event schemas and data contracts. The engineer will be instrumental in rewriting the detection engine to support advanced specifications like Sigma v2, reworking existing pipelines, and building new ones on a common platform. A key responsibility will be developing validation approaches to ensure that re-architected systems maintain equivalent functionality to their predecessors. Additionally, the engineer will focus on building guarantees against quiet failures, implementing end-to-end latency measurement, liveness coverage, and effective alerting. Driving toward a coherent internal standard for schemas and transformers, and building tooling for validation and drift detection are also core aspects of the position.

Requirements

Deep experience designing, building, and operating production distributed systems at scale, primarily in Go.
Ability to work across several layers of the stack.
Experience replacing or substantially re-architecting a live, high-throughput system without breaking its consumers.
Ability to demonstrate how a new path was proven equivalent, how the cut-over was staged, and how it was decided it was safe to retire the old system.
Experience with high-volume event or data pipelines, and understanding of their behavior under load.
Strong operability instincts, including designing observability in from the start.
Experience building alerting that catches the absence of expected work, not just errors.
Demonstrated technical leadership across team boundaries, setting direction and raising the engineering bar without positional authority.
Judgment about production quality: knowing when a system is good enough to ship, when it needs more evaluation, and when it shouldn't ship at all.
Hands-on experience with AI coding tools and a point of view on using them effectively for security outcomes.

Nice To Haves

Background in security operations or security engineering (writing/tuning detections, working in a SOC).
Experience with detection-as-code or other rule- and DSL-driven systems.
Experience building platform tooling for non-engineer authors (rule writers, analysts, researchers).
Ruby on Rails experience.

Responsibilities

Lead major workstreams in detection engine and pipeline modernization.
Own the validation approach to prove reworked pipelines maintain equivalent behavior to their predecessors.
Build guarantees to prevent quiet failures in detection pipelines.
Implement end-to-end latency measurement and liveness coverage.
Develop alerting mechanisms that fire when expected work stops arriving.
Build mechanisms to keep detection volume spikes bounded and recoverable.
Drive toward a coherent internal standard for event schemas and data contracts.
Build validation and drift-detection tooling to catch upstream changes before they break detections.
Write and review production code weekly.
Set technical direction that other engineering teams build against.