About the company
Samsara (NYSE: IOT) is the pioneer of the Connected Operations™ Cloud, which is a platform that enables organizations that depend on physical operations to harness Internet of Things (IoT) data to develop actionable insights and improve their operations.
Responsibilities
- Build, deploy, and continuously improve MITRE ATT&CK–aligned detections across cloud, endpoint, identity, email, and application telemetry, with clear false-positive thresholds.
- Own the full detection lifecycle—from hypothesis, data validation, and baselining through deployment, tuning, validation, and retirement.
- Advance our detection-as-code platform through version control, peer review, automated testing, CI/CD, and improved pipeline reliability and observability.
- Identify emerging threat surfaces and build integrations that strengthen data ingestion, enrichment, and coverage across internal and third-party systems.
- Evaluate AI-powered security capabilities, including secure MCP integrations, threat hunting, anomaly detection, and response automation.
- Turn threat intelligence into actionable detection and retrospective scanning.
- Partner closely with Security Operations during investigations, incidents, table top exercises, detection maintenance, and code pairing.
- Champion, role model, and embed Samsara’s cultural principles as we scale globally and across new offices.
Requirements
- 6+ years in security engineering, detection engineering, or a related technology discipline.
- Strong Python and SQL skills, with experience analyzing large datasets to build and validate detections.
- Hands-on experience with detection-as-code, Git-based workflows, automated testing, and CI/CD deployment.
- Deep experience with modern SIEM platforms, including data onboarding, advanced queries, dashboards, and threat intelligence enrichment.
- Working knowledge of AWS, Linux, containers, and EDR.
- Proven ability to build systems from scratch, lead projects independently, learn new technologies quickly, and communicate technical concepts clearly through documentation, RFCs, and presentations.
Conditions
- Experience with data orchestration platforms such as Airflow or Databricks.
- Applied experience with LLMs, agentic frameworks, and MCP integrations, including their security risks and failure modes.
- Experience with behavioral analytics, anomaly detection, feature engineering, and model evaluation.
- Familiarity with risk-based alerting, ChatOps, distributed alerting, and attack simulation.
- Additional experience with Go, Terraform, malware analysis, digital forensics, or FedRAMP environments.