Senior Threat Detection & Intelligence Engineer

About the Position

We’re looking for a Senior Threat Detection & Intelligence Engineer to help us understand how adversaries operate, detect meaningful threats early, and lead investigations when it matters most. This role sits at the intersection of threat intelligence, detection engineering, and incident investigation with an engineering-first mindset.

If you enjoy turning messy signals into clear attacker narratives, this role is for you.

About the Team

The Cloud Security & Detection & Response (CSDR) team protects Miro by staying ahead of credible threats. We focus on:

• Translating external threat intelligence into actionable detections
• Building custom, high-fidelity detections for cloud and SaaS environments
• Leading complex investigations and incident response
• Partnering with engineering to drive security by design

We care about context, signal quality, and attacker intent not alert volume.

Responsibilities

• Track emerging threats, attacker techniques, and campaigns relevant to cloud and SaaS
• Turn threat intelligence into practical detection strategies and attack hypotheses
• Design and maintain context-aware detections across cloud, identity, and application layers
• Lead deep investigations, from first signal to root cause and remediation
• Act as a technical lead during security incidents, guiding response and decision-making
• Analyze detection and investigation trends to improve preventative controls
• Partner with engineering teams to raise security maturity across the organization

Requirements

• 5–7 years in security, with 2+ years in threat detection, threat intelligence, or investigations
• Experience in cloud-native SaaS environments (AWS strongly preferred)
• Strong investigation skills and ability to analyze attacker behavior
• Experience using threat intelligence to inform detection and response
• Proficiency in Python and comfort automating security workflows
• Experience querying large datasets (SQL or similar)
• Familiarity with cloud security telemetry, logging, and detection platforms
• Solid understanding of incident response and digital forensics
• Experience with Infrastructure as Code (Terraform or similar)

Nice to Have

• Experience in threat intelligence, threat hunting, or security investigations
• Familiarity with attacker TTPs and ability to explain technical risk in business terms

We Offer

• You’ll help define how threat intelligence is used, not just consume it
• You’ll work on real attacker behavior, not checkbox security
• You’ll have room to build, experiment, and improve detection capabilities
• You’ll partner closely with engineers who value security as an engineering problem

Recruiter: #LI-MH1

About the Company

Miro is a visual workspace for innovation that enables distributed teams of any size to build the next big thing. The platform's infinite canvas enables teams to lead engaging workshops and meetings, design products, brainstorm ideas, and more. Miro, co-headquartered in San Francisco and Amsterdam, serves more than 100M users and 250,000 companies collaborate in the Innovation Workspace. Miro was founded in 2011 and currently has more than 1,600 employees in 13 hubs around the world.

We are a team of dreamers. We look for individuals who dream big, work hard, and above all stay humble. Collaboration is at the heart of what we do and through our work together we hope to create a supportive, welcoming, and innovative environment. We strive to play as a team to win the world and create a better version of ourselves every day. If this sounds like something that excites you, we want to hear from you!

Check out more about life at Miro:

• Youtube
• Blog
• Instagram

---

At Miro, we strive to create and foster an environment of belonging and collaboration across cultural differences. Miro’s mission - Empower teams to create the next big thing - is how we think about our product, people, and culture. We believe that creating big things requires diverse and inclusive teams. Diversity invites all talent with different demography, identities, and styles to step in, and inclusion invites them to step closer together. Every day, we are working to build a more diverse Miro, cultivate a sense of belonging for future and current Mironeers around the world, and foster an environment where everyone can collaborate and embrace differences.

Miro handles and uses personal data of job applicants in line with its Recruitment Privacy Policy found here.

Prepare yourself to go beyond

Here are some helpful tips to ensure you have all the correct information throughout our hiring process.

How we hire

• 01. Recruiter Screen: A 30-min interview to discuss your relevant skills, perspective on resilience, experience, and what motivates you to join Miro.
• 02. Hiring Manager: The hiring manager will meet to discuss your experience and fit for the role by assessing whether you align with the Miro Mindset (Curiosity, Drive, Resilience, Empathy, Cognitive Agility & Accountability). This interview usually takes 90-120 minutes.
• 03. Skill Assessment: An interactive presentation to see your skills in action, based around a particular case study or business problem.
• 04. Meet the Team: Here you will meet cross-functional stakeholders, and we will ask evidence-based questions to evaluate how well you align with the role and Miro's values and culture.
• 05. Leadership Round: Meet a member of the leadership team to discuss Miro’s company values and share your vision for success at Miro.

Similar jobs

• Senior Manager – Application Security
• Senior Network Site Reliability Engineer

Back to open positions

Ready to go beyond?