Software Engineer - Detection Platform; GoLang

Reports to:

Engineering Manager

Location:

Remote US

Compensation Range: $200,000 - $220,000 base plus bonus and equity

Cybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organizations. That pushes defenders like us to operate at the highest level, and it deepens our need for good people who want to make a meaningful impact.

Founded in 2015 by former NSA cyber operators, Huntress is a remote-first team working to make enterprise-grade cybersecurity accessible to businesses of all sizes. We work closely with security teams and service providers protecting complex environments, often without the time or headcount to handle it all. That's why we build our technology in-house and back it with a 24/7 human-led Security Operations Center (SOC).

As a result, our platform is never disconnected from the experts who manage it, ensuring our customers' protection.

Huntress now secures more than 5M endpoints and 14M identities worldwide. Those numbers keep growing because more businesses rely on us to help carry the load and operate with more confidence. Every day, you can see that commitment in how we stand with our customers and how we show up for each other.

Huntress protects the small and mid-sized businesses that attackers assume can’t afford a security team. The Detection Platform team builds the engines and pipelines that turn billions of raw telemetry events into the signals our 24/7 SOC acts on. Every detection Huntress ships, across endpoint, identity, SIEM, and third-party EDR, runs through systems this team owns. We measure ourselves on two things: time to detection and detection engine uptime.

We're hiring a Staff Software Engineer to help build and rebuild these systems without disrupting the SOC that depends on them, and to make their behavior predictable under load. This is a hands-on technical leadership role: you'll lead major work streams, set direction that other engineering teams build against, and write and review production code every week.

• Detection engine and pipeline modernization. We're rewriting our detection engine to support the full Sigma v2 specification, including stateful correlation of patterns across many events over time. In parallel, we're reworking several existing detection pipelines and building new ones, moving off the bespoke per-product detectors we've accumulated and onto a common platform. You'll lead major work streams across both and own the validation approach that proves a reworked pipeline still behaves like the one it replaces, so we can turn old paths off knowing we haven't lost anything.
• Reliability and behavior under load. A detection pipeline that quietly stops producing signals is worse than one that crashes loudly, and detection volume spikes for reasons we don't always control. You'll build the guarantees that make quiet failure impossible: end-to-end latency measurement, liveness coverage, and alerting that fires when expected work stops arriving. You'll also build the mechanisms that keep a spike bounded and recoverable.
• Event schemas and data contracts. Our schema and transformer layer are what several other engineering teams build their detections against. You'll help drive toward a coherent internal standard and build the validation and drift-detection tooling that catches upstream changes before they break detections.

• Deep experience designing, building, and operating production distributed systems at scale, primarily in Go, with the range to work across several layers of the stack.
• You have replaced or substantially re-architected a live, high-throughput system without breaking its consumers, and you can walk us through how you proved the new path was equivalent, staged the cut-over, and decided it was safe to retire the old one.
• Experience with high-volume event or data pipelines, and a good feel for how they behave under load: where things queue, where they fall behind, and what happens to correctness when they do.
• Strong operability instincts. You design observability in rather than retrofitting it, and you've…