Huntress

You would define and improve global 24/7 SOC workflows and playbooks, scale operations, mentor analysts, and work with other teams to strengthen detection and incident response. | The role requires at least five years as a security analyst in a global 24/7 SOC focused on Windows forensics and three years leading teams in an MSSP, MDR, or incident-response setting. | What We Do: Cybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organizations. That pushes defenders like us to operate at the highest level, and it deepens our need for good people who want to make a meaningful impact. Founded in 2015 by former NSA cyber operators, Huntress is a remote-first team working to make enterprise-grade cybersecurity accessible to businesses of all sizes. We work closely with security teams and service providers protecting complex environments, often without the time or headcount to handle it all. That’s why we build our technology in-house and back it with a 24/7 human-led Security Operations Center (SOC). As a result, our platform is never disconnected from the experts who manage it, ensuring our customers' protection. Huntress now secures more than 5M endpoints and 16M identities worldwide. Those numbers keep growing because more businesses rely on us to help carry the load and operate with more confidence. Every day, you can see that commitment in how we stand with our customers and how we show up for each other. Reports to: Director, Security Operations Center Location: Remote US Compensation: $165,000-$185,000 base plus bonus and equity What You’ll Do: The Huntress Security Operations Center is a global team of security analysts dedicated to investigating and responding to incidents on our partners’ networks 24/7, 365 days a year. Daily activities consist of providing investigation, containment, and response actions across millions of endpoints. This role is accountable for defining and streamlining processes, workflows, and playbooks that enable effective day-to-day operations. As Huntress continues to grow, we are laser-focused on scaling our operations and force-multiplying our human analysts by 10X. This position is responsible for enabling analysts to meet our mission and achieve internal Service Level Objectives for response times. The Security Operations Manager will work with their peer regional managers to ensure consistent global operations while providing our analyst team with training opportunities and career growth. Responsibilities: Design, implement, and enforce internal processes to reduce burnout and increase the productivity of the operations center against a global set of expectations and standards Manage and enforce local/global shift coverage to ensure 24/7 operations are maintained 365 days a year Meet with analysts in a 1:1 setting weekly to socialize focus initiatives, gather feedback, provide feedback, and enable analysts to progress rapidly in their career Contribute to the development and implementation of analyst training programs designed to streamline onboarding and advance analyst skill sets in Digital Forensics, Incident Response, Malware Analysis, Detection Engineering, Threat Hunting, and Automation Work with the Product organizations to prioritize the creation of new capabilities designed to augment and force multiple analyst capabilities Maintain accountability for routine quality assurance for your designated region Engage with our Support organization to create streamlined workflows for partner/customer requests that need Security Operations Center analysis Strengthen and mature our existing processes and relationships with our Tactical Response, Threat Hunting, and Detection Engineering teams within the Security organization Provide one level of technical leadership for analysts of the Security Operations Center analysts Ensure team members fully understand the goals and objectives of Huntress’ mission and how their work fits into the bigger picture Provide key input and guidance to company stakeholders such as Marketing, Sales, Support, and Product Develop, track, and report on Objectives and Key Results linked to Security Operations Center focus initiatives Help operationalize new technologies and services that Huntress brings to market Participate in public speaking engagements in both webinar and in-person formats What You Bring To The Team: Experience in leading diverse cybersecurity teams with various skills. These teams work in Security Operations, Digital Forensics, Incident Response, Malware Analysis, Threat Hunting, and Detection Engineering 5+ years of Security Analyst experience working in a global 24x7 security operations center with a focus on Windows forensics 3+ year of team lead or managerial experience in a global operations center or Incident Response role. Preferably within a MSSP, MDR provider, or Incident Response service. Actively engaged in the information security community by attending conferences or contributing to conversations/projects in the public domain Continually learning and staying up to date on the latest threat actor tradecraft, detection techniques, and security operations concepts Ability to identify workflows being performed and create detailed process diagrams and operating procedures Effective communicator of highly technical concepts to stakeholders of varying technical backgrounds Demonstrated experience leading initiatives or projects that required delegation and accountability to achieve success Data-driven approach with experience in Data Science concepts What We Offer: 100% remote work environment - since our founding in 2015 Generous paid time off policy, including vacation, sick time, and paid holidays 12 weeks of paid parental leave Highly competitive and comprehensive medical, dental, and vision benefits plans 401(k) with a 5% contribution regardless of employee contribution Life and Disability insurance plans Stock options for all full-time employees One-time $500 reimbursement for building/upgrading home office Annual allowance for education and professional development assistance $75 USD/month digital reimbursement Access to the BetterUp platform for coaching, personal, and professional growth Huntress is committed to creating a culture of inclusivity where every single member of our team is valued, has a voice, and is empowered to come to work every day just as they are. We do not discriminate based on race, ethnicity, color, ancestry, national origin, religion, sex, sexual orientation, gender identity, disability, veteran status, genetic information, marital status, or any other legally protected status. We do discriminate against hackers who try to exploit businesses of all sizes. Accommodations: If you require reasonable accommodation to complete this application, interview, or pre-employment testing or participate in the employee selection process, please direct your inquiries to accommodations@huntresslabs.com. Please note that non-accommodation requests to this inbox will not receive a response. Huntress uses artificial intelligence tools to assist in reviewing and evaluating job applications, including resume screening, skills assessment, and candidate matching and comparisons. These AI tools support our human recruiters in the initial review process, but do not make final hiring decisions without human involvement. By submitting your application, you acknowledge this use of AI in our recruitment process. Please review our Candidate Privacy Notice for more details on our practices and your data privacy rights. #BI-Remote Huntress is committed to creating a culture of inclusivity where every single member of our team is valued, has a voice, and is empowered to come to work every day just as they are. We do not discriminate based on race, ethnicity, color, ancestry, national origin, religion, sex, sexual orientation, gender identity, disability, veteran status, genetic information, marital status, or any other legally protected status. We do discriminate against hackers who try to exploit businesses of all sizes. Accommodations: If you require reasonable accommodation to complete this application, interview, or pre-employment testing or participate in the employee selection process, please direct your inquiries to accommodations@huntresslabs.com. Please note that non-accommodation requests to this inbox will not receive a response. Huntress uses artificial intelligence tools to assist in reviewing and evaluating job applications, including resume screening, skills assessment, and candidate matching and comparisons. These AI tools support our human recruiters in the initial review process, but do not make final hiring decisions without human involvement. By submitting your application, you acknowledge this use of AI in our recruitment process. Please review our Candidate Privacy Notice for more details on our practices and your data privacy rights. #BI-Remote

Lead enterprise automation strategy and build secure, AI-enabled workflows and integrations across company systems. | Requires 7+ years in automation engineering or systems integration, with workflow platforms, Azure, Entra, Intune, programming, and SaaS security experience. | What We Do: Cybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organizations. That pushes defenders like us to operate at the highest level, and it deepens our need for good people who want to make a meaningful impact. Founded in 2015 by former NSA cyber operators, Huntress is a remote-first team working to make enterprise-grade cybersecurity accessible to businesses of all sizes. We work closely with security teams and service providers protecting complex environments, often without the time or headcount to handle it all. That’s why we build our technology in-house and back it with a 24/7 human-led Security Operations Center (SOC). As a result, our platform is never disconnected from the experts who manage it, ensuring our customers' protection. Huntress now secures more than 5M endpoints and 16M identities worldwide. Those numbers keep growing because more businesses rely on us to help carry the load and operate with more confidence. Every day, you can see that commitment in how we stand with our customers and how we show up for each other. Reports to: Manager, IT Solutions Engineering Location: Remote US Compensation Range: $130,000 to $140,000 base plus bonus and equity What You’ll Do: As a Senior IT Automation Engineer on the IT Solutions Engineering team, you will shape how Huntress uses automation and AI to work smarter, move faster, and scale securely. You will own the strategy and operating model for our Automation and Agentic AI Center of Excellence, turning tools such as Claude, Glean, Zapier, and related platforms into practical systems that improve how teams get work done. You embrace continuous improvement by testing what has the most leverage, learning quickly, and improving the patterns that scale. You find friction before it becomes someone else’s problem and owning the path from idea to adoption. You measure success by the operational impact, security, and value your systems create across Huntress.You’ll work side by side with the rest of the IT Solution Engineering team and automation engineering peers to accomplish your work. Responsibilities: Lead cross-functional initiatives that use automation to improve operational scale, employee experience, and business execution. Own the enterprise automation and integration stack, including Zapier and connected business systems, while ensuring performance, maintainability, and security alignment. Establish and operate the Automation and Agentic AI Center of Excellence, including standards, governance, documentation, intake, and prioritization practices. Build reusable frameworks, templates, libraries, and design patterns that help enable self service and deliver reliable solutions faster with more consistency. Represent IT with Internal Innovation to collaborate on AI adoption, feature enablement, and governance. Design modular, resilient integration patterns and automation pipelines with secure data handling, role-based access control, and least-privilege principles built in. Analyze operational inefficiencies, identify high-value opportunities, and deliver data-informed recommendations and roadmaps to leadership. Re-engineer meaningful parts of the operational layer with AI, using tools such as Claude and Glean to create reusable workflows that preserve human judgment, security, and measurable outcomes. What You Bring To The Team: You have 7+ years of experience in automation engineering, systems integration, or a similar technical leadership role, with experience on or partnering closely with IT teams. You have set automation strategy, translated organizational goals into practical roadmaps, and guided initiatives from concept through adoption. You have hands-on experience with enterprise workflow platforms, API-based integrations, and Microsoft tooling such as Azure, Entra, and Intune, along with Python or JavaScript/TypeScript scripting and version-controlled delivery practices. You understand SaaS security, identity and access management, credential protection, privacy-aware data handling, and the risk assessment of new integrations. You can diagnose root causes, weigh automation against manual processes, and make clear decisions about where standardization creates the most value. You communicate technical trade-offs clearly with engineers, business partners, and executive stakeholders, and you can guide teams toward maintainable solutions. You have re-engineered workflows with AI and can design reusable systems that let tools such as Claude and Glean run meaningful parts of the operational layer while keeping human judgment, security, and measurable outcomes in the loop. What We Offer: 100% remote work environment - since our founding in 2015 Generous paid time off policy, including vacation, sick time, and paid holidays 12 weeks of paid parental leave Highly competitive and comprehensive medical, dental, and vision benefits plans 401(k) with a 5% contribution regardless of employee contribution Life and Disability insurance plans Stock options for all full-time employees One-time $500 reimbursement for building/upgrading home office Annual allowance for education and professional development assistance $75 USD/month digital reimbursement Access to the BetterUp platform for coaching, personal, and professional growth Huntress is committed to creating a culture of inclusivity where every single member of our team is valued, has a voice, and is empowered to come to work every day just as they are. We do not discriminate based on race, ethnicity, color, ancestry, national origin, religion, sex, sexual orientation, gender identity, disability, veteran status, genetic information, marital status, or any other legally protected status. We do discriminate against hackers who try to exploit businesses of all sizes. Accommodations: If you require reasonable accommodation to complete this application, interview, or pre-employment testing or participate in the employee selection process, please direct your inquiries to accommodations@huntresslabs.com. Please note that non-accommodation requests to this inbox will not receive a response. Huntress uses artificial intelligence tools to assist in reviewing and evaluating job applications, including resume screening, skills assessment, and candidate matching and comparisons. These AI tools support our human recruiters in the initial review process, but do not make final hiring decisions without human involvement. By submitting your application, you acknowledge this use of AI in our recruitment process. Please review our Candidate Privacy Notice for more details on our practices and your data privacy rights. #BI-Remote

Design reliable, observable, secure agentic SOC components that use LLMs to investigate security signals and automate analyst workflows in collaboration with security analysts and researchers. | Requires 6+ years of professional software development, backend and LLM application experience, backend language proficiency, security principles, and a bachelor’s or postgraduate degree. | What We Do: Cybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organizations. That pushes defenders like us to operate at the highest level, and it deepens our need for good people who want to make a meaningful impact. Founded in 2015 by former NSA cyber operators, Huntress is a remote-first team working to make enterprise-grade cybersecurity accessible to businesses of all sizes. We work closely with security teams and service providers protecting complex environments, often without the time or headcount to handle it all. That’s why we build our technology in-house and back it with a 24/7 human-led Security Operations Center (SOC). As a result, our platform is never disconnected from the experts who manage it, ensuring our customers' protection. Huntress now secures more than 5M endpoints and 16M identities worldwide. Those numbers keep growing because more businesses rely on us to help carry the load and operate with more confidence. Every day, you can see that commitment in how we stand with our customers and how we show up for each other. Reports to: Director, Engineering Location: Remote US, Only Compensation: $165,000 to $190,000 base plus bonus and equity What You’ll Do: Huntress is building an Agentic SOC. When our detection pipeline raises a signal, an LLM-based agent picks it up and investigates it end-to-end. It gathers telemetry across our products, reconstructs what happened, and makes a well-documented determination about whether the activity is malicious. Over time, it will take on more of the work itself, growing from resolving routine cases to acting fast when it finds an attack and handing analysts cases with the evidence already assembled. This system is meant to augment our analysts, not replace them. It takes the high-volume, repetitive work off their plates so they can focus on complex cases and hands-on keyboard intrusions where human expertise matters most. It also reduces toil in the rest of their day by using LLMs to pre-process the output of the tools analysts use constantly, so they start from a clear picture instead of raw telemetry. This isn’t a chatbot bolted onto a dashboard. The system investigates a large volume of signals a day across thousands of customer organizations. Many signals are benign, but some are live intrusions where minutes matter. The telemetry the system reads comes from environments where attackers are actively operating. Because the system makes real decisions, like closing an investigation or isolating a host, it has to be right, it has to show its work, and it has to know when to hand off to a person. As a Senior Software Engineer on the Agentic SOC team, you’ll build and ship core parts of this system. You’ll work closely with the team’s technical leads, SOC analysts, product researchers, and product managers. You’ll own significant pieces end-to-end, from an ambiguous problem to a production feature you can show is working. We make full use of AI coding tools to enable you to accelerate your development. We don’t cap token usage. We expect you to use AI and all tools responsibly. Responsibilities: Build the investigation system. You design, build, and ship the components that make agentic investigation work: the tools agents use to query telemetry, the logic that drives an investigation, and the structured, evidence-backed output that analysts and customers see. Turn analyst expertise into agent behavior. You sit with SOC analysts and product researchers to understand how they triage and investigate a given kind of Signal, then encode that into what the agent looks for, what it gathers, and how it explains its conclusions. Take toil off analysts’ plates. You build LLM-powered features that pre-process the output of tools analysts use every day. They summarize, correlate, and highlight what matters, so analysts spend their time on judgment instead of assembly. Measure what you ship. You build and extend the evaluations that tell us whether the system is getting better or worse, and you back your changes with evidence rather than a handful of good-looking examples. Build with a security mindset. The agent reads attacker-influenced data, runs across thousands of customer tenants, and can take action in customer environments. You think about how what you build could be misused or manipulated, and you design for it. Build for production. You write reliable, observable, cost-conscious code that behaves well when models are slow, wrong, or unavailable. You operate what you build and help keep the system healthy as new detections and products come online. Collaborate and raise the bar. You give thoughtful code reviews, help teammates get unstuck, share what you learn about building with LLMs, and contribute to technical discussions and design reviews with clear reasoning about tradeoffs. Balance rigor with pragmatism. You know when to prototype quickly to learn something and when to slow down because the cost of being wrong is high. What You Bring To The Team: 6+ years of professional software development experience, including building and operating production backend systems Experience building applications with LLMs, including tool use, structured output, prompt and context design, and evaluation. Experience shipping agents to production is a strong plus An understanding of how LLM-based systems fail, and good habits for testing and debugging non-deterministic behavior Solid backend fundamentals, including APIs, background jobs and queues, concurrency, relational databases such as Postgres, and data stores such as Redis Strong skills in one or more backend languages and the ability to pick up new ones quickly. Our primary stack is Ruby on Rails. Prior Rails experience isn’t required, and we expect you to become fluent in it Security awareness: you think about untrusted input, access control, and keeping one customer’s data separate from another’s Curiosity about how security analysts think and work, and a willingness to spend real time learning from them Experience with AWS, Azure, or other public cloud environments Experience with AI coding tools, such as Claude Code BS or MS in Computer Science or Engineering, or equivalent experience Bonus Points: Experience working in or building for a SOC, incident response, threat hunting, or detection engineering. It isn’t required, but it helps a lot, because we build these workflows around how our analysts actually investigate Familiarity with endpoint, identity, and Microsoft 365 telemetry and with attacker tradecraft (e.g., MITRE ATT&CK) Experience building evaluation pipelines or datasets for ML or LLM systems Experience with Ruby on Rails What We Offer: 100% remote work environment - since our founding in 2015 Generous paid time off policy, including vacation, sick time, and paid holidays 12 weeks of paid parental leave Highly competitive and comprehensive medical, dental, and vision benefits plans 401(k) with a 5% contribution regardless of employee contribution Life and Disability insurance plans Stock options for all full-time employees One-time $500 reimbursement for building/upgrading home office Annual allowance for education and professional development assistance $75 USD/month digital reimbursement Access to the BetterUp platform for coaching, personal, and professional growth #BI-REMOTE Huntress is committed to creating a culture of inclusivity where every single member of our team is valued, has a voice, and is empowered to come to work every day just as they are. We do not discriminate based on race, ethnicity, color, ancestry, national origin, religion, sex, sexual orientation, gender identity, disability, veteran status, genetic information, marital status, or any other legally protected status. We do discriminate against hackers who try to exploit businesses of all sizes. Accommodations: If you require reasonable accommodation to complete this application, interview, or pre-employment testing or participate in the employee selection process, please direct your inquiries to accommodations@huntresslabs.com. Please note that non-accommodation requests to this inbox will not receive a response. Huntress uses artificial intelligence tools to assist in reviewing and evaluating job applications, including resume screening, skills assessment, and candidate matching and comparisons. These AI tools support our human recruiters in the initial review process, but do not make final hiring decisions without human involvement. By submitting your application, you acknowledge this use of AI in our recruitment process. Please review our Candidate Privacy Notice for more details on our practices and your data privacy rights. #BI-Remote

Drive technical vision and architecture of Core Platform while mentoring and managing cross-team dependencies. | 10+ years development experience with 5+ years Ruby on Rails, strong architecture and cloud infrastructure expertise, and leadership ability. | Reports to: Engineering Manager Location: Remote US Compensation Range: $200,000 to $220,000 base plus bonus and equity What We Do: Cybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organizations. That pushes defenders like us to operate at the highest level, and it deepens our need for good people who want to make a meaningful impact. Founded in 2015 by former NSA cyber operators, Huntress is a remote-first team working to make enterprise-grade cybersecurity accessible to businesses of all sizes. We work closely with security teams and service providers protecting complex environments, often without the time or headcount to handle it all. That’s why we build our technology in-house and back it with a 24/7 human-led Security Operations Center (SOC). As a result, our platform is never disconnected from the experts who manage it, ensuring our customers' protection. Huntress now secures more than 5M endpoints and 11M identities worldwide. Those numbers keep growing because more businesses rely on us to help carry the load and operate with more confidence. Every day, you can see that commitment in how we stand with our customers and how we show up for each other. What You’ll Do: Huntress is looking for a highly strategic and collaborative Staff Software Engineer to drive the technical vision and architectural evolution of the Huntress Core Platform. Our Core Platform contains the foundational components that power the entire Huntress product suite, including the notification system, onboarding, authentication, integrations, and APIs. While you will remain deeply hands-on developing the most complex features for the platform, your scope expands beyond standard delivery. You will act as the technical anchor for your team, solving our most complex scaling challenges and eliminating cross-team dependencies. You will design the systems that empower all other engineering teams to build faster and more securely, acting as a technical thought leader who ensures our architecture anticipates future growth as we scale to protect the 99%. Responsibilities: Design, implement and mentor engineers on the most complex features the team builds Partner directly with the Engineering Manager to steer the team’s technical direction, improve overall team function, and set the standard for engineering excellence Take ownership of cross-team dependencies, actively collaborating with multiple engineering teams to eliminate roadblocks and ensure smooth feature delivery. Drive the Architectural Decision Record (ADR) process for major technical changes that impact the wider codebase or require alignment across multiple functions Focus on the entire lifecycle of the system, including evolution, configuration and technical risk management Mentor and coach engineers across the team, acting as a positive role model who promotes collaboration and engagement What You Bring To The Team: 10+ years of experience developing complex software products, with a proven track record of acting as the senior technical anchor for a team 5+ years of programming in Ruby on Rails, ideally with experience managing and scaling large monoliths Strong architectural experience, including a history of driving technical design decisions (ADRs) and managing system lifecycles, configuration and technical risk Experience with AWS or other public cloud environments, Linux-based infrastructure and advanced database management at scale Excellent technical, diagnostic, and troubleshooting skills Ability to grasp new tools and technologies quickly Ability to prioritize and execute multiple tasks at a time in a fast-paced environment, often operating independently Demonstrated ability to take highly ambiguous requirements or multi-team initiatives and decompose them into actionable work for the team Exceptional communication skills, with the ability to build strong relationships and coordinate smoothly across multiple teams, product managers, and leadership Experience partnering directly with Engineering Managers or Product Leaders to set team-level technical strategy and balance tech debt with product delivery Experience with AI coding tools and workflows, with the ability to help the wider team adopt them effectively, responsibly, and pragmatically What We Offer: 100% remote work environment - since our founding in 2015 Generous paid time off policy, including vacation, sick time, and paid holidays 12 weeks of paid parental leave Highly competitive and comprehensive medical, dental, and vision benefits plans 401(k) with a 5% contribution regardless of employee contribution Life and Disability insurance plans Stock options for all full-time employees One-time $500 reimbursement for building/upgrading home office Annual allowance for education and professional development assistance $75 USD/month digital reimbursement Access to the BetterUp platform for coaching, personal, and professional growth Huntress is committed to creating a culture of inclusivity where every single member of our team is valued, has a voice, and is empowered to come to work every day just as they are. We do not discriminate based on race, ethnicity, color, ancestry, national origin, religion, sex, sexual orientation, gender identity, disability, veteran status, genetic information, marital status, or any other legally protected status. We do discriminate against hackers who try to exploit small businesses. Accommodations: If you require reasonable accommodation to complete this application, interview, or pre-employment testing or participate in the employee selection process, please direct your inquiries to accommodations@huntresslabs.com. Please note that non-accommodation requests to this inbox will not receive a response. If you have questions about your personal data privacy at Huntress, please visit our privacy page. #BI-Remote

Lead and grow detection engineering and threat hunting operations, managing budgets and scaling teams. | 5+ years leading technical security teams with strong strategic and technical skills in adversary tradecraft and distributed team management. | Reports to: Director of Detection Engineering and Threat Hunting Location: Remote, US Compensation: $220,000 to $240,000 base plus bonus and equity What We Do: Cybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organizations. That pushes defenders like us to operate at the highest level, and it deepens our need for good people who want to make a meaningful impact. Founded in 2015 by former NSA cyber operators, Huntress is a remote-first team working to make enterprise-grade cybersecurity accessible to businesses of all sizes. We work closely with security teams and service providers protecting complex environments, often without the time or headcount to handle it all. That’s why we build our technology in-house and back it with a 24/7 human-led Security Operations Center (SOC). As a result, our platform is never disconnected from the experts who manage it, ensuring our customers' protection. Huntress now secures more than 5M endpoints and 11M identities worldwide. Those numbers keep growing because more businesses rely on us to help carry the load and operate with more confidence. Every day, you can see that commitment in how we stand with our customers and how we show up for each other. What You’ll Do: We are seeking an experienced leader to own the strategy, execution, and growth of our North American Detection Engineering & Threat Hunting (DE&TH) operations. While you will align with the DE&TH Director on the overarching 18-month vision, you will have autonomy to drive the operational tempo and outcomes for your region. You will provide weekly supervision to focus on scaling the team, managing regional hiring/budgeting, and serving as a strategic partner to Product and Engineering. You will manage a team of technical practitioners. Your mission is to operationalize our "hunt-to-detect" feedback loop at scale, ensuring that our detection portfolio matures in lock-step with our platform's growth, while collaborating with your counterparts in other regions to ensure a seamless, 24/7 global defense. Responsibilities: Regional Operational Leadership: Own the execution of the DE&TH mission for the North America region. You will translate global strategic goals into actionable regional roadmaps, ensuring that our NA-based hunters and engineers are focused on the highest-value threats. Team Scaling & Talent Strategy: Manage and grow a team of practitioners. You are responsible for the region's hiring strategy, capacity modeling, and performance management. You will mentor up to Staff and Principal practitioners, helping them navigate technical leadership paths. Cross-Functional Alignment: Strategize with leaders in Product, Engineering, and Security. Global Collaboration: Partner closely with regional managers in EMEA/APAC to ensure consistent standards, seamless handoffs, and shared knowledge. You will ensure that "how we hunt" in North America contributes to and benefits from our global ecosystem, preventing regional silos. Incident Command: Serve as the senior leadership point of contact for DE&TH during North American business hours. During high-impact security incidents or mass exploitation events, you will provide calm, strategic direction to the team and effective communication to executive stakeholders. Efficacy & Accountability: You are responsible for the results of the NA region. You will track and report on key performance indicators and drive systemic improvements when metrics deviate from our standards. What You Bring To The Team: Proven Management Experience: 5+ years of experience leading technical security teams (Detection Engineering, Hunting, or IR), with specific experience managing distributed or remote teams. Strategic Mindset: You can balance local autonomy with global alignment. You know how to run your region as a business unit—managing resources and priorities—while adhering to global standards. Technical Gravity: While you are less involved in day-to-day coding than a Team Lead, you possess the technical depth to guide Staff/Principal Engineers. You understand "Detection-as-Code" principles, adversary tradecraft, and can adjudicate complex technical disagreements. Advocacy & Communication: You are a skilled advocate for your team. You can effectively communicate the value of proactive hunting to non-technical stakeholders and negotiate with Product/Engineering for the tooling and telemetry your team needs to succeed. What We Offer: 100% remote work environment - since our founding in 2015 Generous paid time off policy, including vacation, sick time, and paid holidays 12 weeks of paid parental leave Highly competitive and comprehensive medical, dental, and vision benefits plans 401(k) with a 5% contribution regardless of employee contribution Life and Disability insurance plans Stock options for all full-time employees One-time $500 reimbursement for building/upgrading home office Annual allowance for education and professional development assistance $75 USD/month digital reimbursement Access to the BetterUp platform for coaching, personal, and professional growth Huntress is committed to creating a culture of inclusivity where every single member of our team is valued, has a voice, and is empowered to come to work every day just as they are. We do not discriminate based on race, ethnicity, color, ancestry, national origin, religion, sex, sexual orientation, gender identity, disability, veteran status, genetic information, marital status, or any other legally protected status. We do discriminate against hackers who try to exploit businesses of all sizes. Accommodations: If you require reasonable accommodation to complete this application, interview, or pre-employment testing or participate in the employee selection process, please direct your inquiries to accommodations@huntresslabs.com. Please note that non-accommodation requests to this inbox will not receive a response. Huntress uses artificial intelligence tools to assist in reviewing and evaluating job applications, including resume screening, skills assessment, and candidate matching and comparisons. These AI tools support our human recruiters in the initial review process, but do not make final hiring decisions without human involvement. By submitting your application, you acknowledge this use of AI in our recruitment process. Please review our Candidate Privacy Notice for more details on our practices and your data privacy rights. #BI-Remote

Lead modernization of detection engines and pipelines ensuring system reliability and performance. | Deep experience with distributed systems in Go, strong technical leadership, and security engineering background preferred. | Reports to: Engineering Manager Location: Remote US Compensation Range: $200,000 - $220,000 base plus bonus and equity What We Do: Cybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organizations. That pushes defenders like us to operate at the highest level, and it deepens our need for good people who want to make a meaningful impact. Founded in 2015 by former NSA cyber operators, Huntress is a remote-first team working to make enterprise-grade cybersecurity accessible to businesses of all sizes. We work closely with security teams and service providers protecting complex environments, often without the time or headcount to handle it all. That’s why we build our technology in-house and back it with a 24/7 human-led Security Operations Center (SOC). As a result, our platform is never disconnected from the experts who manage it, ensuring our customers' protection. Huntress now secures more than 5M endpoints and 14M identities worldwide. Those numbers keep growing because more businesses rely on us to help carry the load and operate with more confidence. Every day, you can see that commitment in how we stand with our customers and how we show up for each other. About the Team Huntress protects the small and mid-sized businesses that attackers assume can't afford a security team. The Detection Platform team builds the engines and pipelines that turn billions of raw telemetry events into the signals our 24/7 SOC acts on. Every detection Huntress ships, across endpoint, identity, SIEM, and third-party EDR, runs through systems this team owns. We measure ourselves on two things: time to detection and detection engine uptime. About the Role We're hiring a Staff Software Engineer to help build and rebuild these systems without disrupting the SOC that depends on them, and to make their behavior predictable under load. This is a hands-on technical leadership role: you'll lead major workstreams, set direction that other engineering teams build against, and write and review production code every week. What You'll Own Detection engine and pipeline modernization. We're rewriting our detection engine to support the full Sigma v2 specification, including stateful correlation of patterns across many events over time. In parallel, we're reworking several existing detection pipelines and building new ones, moving off the bespoke per-product detectors we've accumulated and onto a common platform. You'll lead major workstreams across both and own the validation approach that proves a reworked pipeline still behaves like the one it replaces, so we can turn old paths off knowing we haven't lost anything. Reliability and behavior under load. A detection pipeline that quietly stops producing signals is worse than one that crashes loudly, and detection volume spikes for reasons we don't always control. You'll build the guarantees that make quiet failure impossible: end-to-end latency measurement, liveness coverage, and alerting that fires when expected work stops arriving. You'll also build the mechanisms that keep a spike bounded and recoverable. Event schemas and data contracts. Our schema and transformer layer are what several other engineering teams build their detections against. You'll help drive toward a coherent internal standard and build the validation and drift-detection tooling that catches upstream changes before they break detections. What We're Looking For Required Deep experience designing, building, and operating production distributed systems at scale, primarily in Go, with the range to work across several layers of the stack. You have replaced or substantially re-architected a live, high-throughput system without breaking its consumers, and you can walk us through how you proved the new path was equivalent, staged the cut-over, and decided it was safe to retire the old one. Experience with high-volume event or data pipelines, and a good feel for how they behave under load: where things queue, where they fall behind, and what happens to correctness when they do. Strong operability instincts. You design observability in rather than retrofitting it, and you've built alerting that catches the absence of expected work, not just errors. Demonstrated technical leadership across team boundaries. You've set a direction that other teams had to build against and raised the engineering bar around you, without needing positional authority. Judgment about production quality: when a system is good enough to ship, when it needs more evaluation, and when it shouldn't ship at all. Hands-on experience with AI coding tools, and a point of view on using them well, where correctness is a security outcome. Strongly Preferred A background in security operations or security engineering: time spent writing or tuning detections, or working in a SOC. You know what makes a detection maintainable, how fast noise erodes a SOC's trust in its tooling, and why a missed detection is a different class of failure than a noisy one. Experience with detection-as-code or other rule- and DSL-driven systems, including the parsing and evaluation work that supporting a specification properly entails. Experience building platform tooling for non-engineer authors such as rule writers, analysts, and researchers, where the product surface is a language, an API, and a feedback loop. Ruby on Rails experience. Some of our pipeline and application code is Rails, and you'll occasionally read and review Ruby. It's a nice-to-have, not a requirement; we'll help you ramp. Our Stack You'll work primarily in Go across our detection engines, pipelines, and the services around them, with Kafka, Temporal, Redis, ClickHouse, Elasticsearch, and Kubernetes across AWS and Azure. Some of our pipeline and application code is Ruby on Rails. Detection logic is written in Sigma. We don't expect prior experience with all of it, and we're not screening on the list; Go is the one language we'll assess directly in interviews. You should be someone who likes being fluent across a broad stack rather than being specialized in one corner of it. What We Offer: 100% remote work environment - since our founding in 2015 Generous paid time off policy, including vacation, sick time, and paid holidays 12 weeks of paid parental leave Highly competitive and comprehensive medical, dental, and vision benefits plans 401(k) with a 5% contribution regardless of employee contribution Life and Disability insurance plans Stock options for all full-time employees One-time $500 reimbursement for building/upgrading home office Annual allowance for education and professional development assistance $75 USD/month digital reimbursement Access to the BetterUp platform for coaching, personal, and professional growth Huntress is committed to creating a culture of inclusivity where every single member of our team is valued, has a voice, and is empowered to come to work every day just as they are. We do not discriminate based on race, ethnicity, color, ancestry, national origin, religion, sex, sexual orientation, gender identity, disability, veteran status, genetic information, marital status, or any other legally protected status. We do discriminate against hackers who try to exploit businesses of all sizes. Accommodations: If you require reasonable accommodation to complete this application, interview, or pre-employment testing or participate in the employee selection process, please direct your inquiries to accommodations@huntresslabs.com. Please note that non-accommodation requests to this inbox will not receive a response. Huntress uses artificial intelligence tools to assist in reviewing and evaluating job applications, including resume screening, skills assessment, and candidate matching and comparisons. These AI tools support our human recruiters in the initial review process, but do not make final hiring decisions without human involvement. By submitting your application, you acknowledge this use of AI in our recruitment process. Please review our Candidate Privacy Notice for more details on our practices and your data privacy rights. #BI-Remote