Staff Software Engineer - Detection Platform (GoLang)

What We Do

Founded in 2015 by former NSA cyber operators, Huntress is a remote-first team working to make enterprise-grade cybersecurity accessible to businesses of all sizes. We work closely with security teams and service providers protecting complex environments, often without the time or headcount to handle it all. That’s why we build our technology in-house and back it with a 24/7 human-led Security Operations Center (SOC).

Huntress now secures more than 5M endpoints and 14M identities worldwide. Every day, you can see that commitment in how we stand with our customers and how we show up for each other.

About the Team

Huntress protects small and mid-sized businesses that attackers assume can't afford a security team. The Detection Platform team builds the engines and pipelines that turn billions of raw telemetry events into the signals our 24/7 SOC acts on. Every detection Huntress ships, across endpoint, identity, SIEM, and third-party EDR, runs through systems this team owns. We measure ourselves on two things: time to detection and detection engine uptime.

About the Role

We're hiring a Staff Software Engineer to help build and rebuild these systems without disrupting the SOC that depends on them, and to make their behavior predictable under load. This is a hands-on technical leadership role: you'll lead major workstreams, set direction that other engineering teams build against, and write and review production code every week.

What You'll Own

• Detection engine and pipeline modernization: Rewriting our detection engine to support the full Sigma v2 specification, including stateful correlation of patterns across many events over time. Reworking existing detection pipelines and building new ones, moving off bespoke per-product detectors onto a common platform.
• Reliability and behavior under load: Building the guarantees that make quiet failure impossible: end-to-end latency measurement, liveness coverage, and alerting that fires when expected work stops arriving. Keeping spikes bounded and recoverable.
• Event schemas and data contracts: Driving toward a coherent internal standard and building validation and drift-detection tooling that catches upstream changes before they break detections.

What We're Looking For

Required

• Deep experience designing, building, and operating production distributed systems at scale, primarily in Go.
• Experience replacing or substantially re-architecting a live, high-throughput system without breaking its consumers.
• Experience with high-volume event or data pipelines and how they behave under load.
• Strong operability instincts with production-grade observability and alerting.
• Demonstrated technical leadership across team boundaries without positional authority.
• Strong judgment about production quality and when systems are ready to ship.
• Hands-on experience with AI coding tools.

Strongly Preferred

• Background in security operations, security engineering, or writing and tuning detections.
• Experience with detection-as-code or other rule- and DSL-driven systems.
• Experience building platform tooling for non-engineer authors.
• Ruby on Rails experience (nice-to-have).

Our Stack

• Languages: Go, Ruby on Rails, Sigma (detection logic)
• Infrastructure & Tools: Kafka, Temporal, Redis, ClickHouse, Elasticsearch, Kubernetes, AWS, Azure

What We Offer

• 100% remote work environment
• Generous paid time off policy, including vacation, sick time, and paid holidays
• 12 weeks of paid parental leave
• Highly competitive medical, dental, and vision benefits plans
• 401(k) with a 5% contribution regardless of employee contribution
• Life and Disability insurance plans
• Stock options for all full-time employees
• One-time $500 home office reimbursement
• Annual education and professional development allowance
• $75 USD/month digital reimbursement
• Access to the BetterUp platform for coaching and personal growth