Staff Security Engineer - Threat Detection

At Snowflake, we are powering the era of the agentic enterprise. To usher in this new era, we seek AI-native thinkers across every function who are energized by the opportunity to reinvent how they work. You don’t just use tools; you possess an innate curiosity, treating AI as a high-trust collaborator that is core to how you solve problems and accelerate your impact. We look for low-ego individuals who thrive in dynamic and fast-moving environments and move with an experimental mindset — who rapidly test emerging capabilities to discover simpler, more powerful ways to deliver results. At Snowflake, your role isn't just to execute a function, but to help redefine the future of how work gets done. We are hiring a Staff Security Engineer, Threat Detection for our Security team. This is a fully remote role open to candidates across the United States. As Snowflake scales globally, we are investing heavily in AI-powered threat detection and response to protect our customers and our environment at cloud scale. This role helps enhance and extend the reach of Snowflake's Threat Detection Program, with AI and automation as core primitives in how we detect, triage, and respond to threats. You will combine deep security expertise with strong engineering skills to build, maintain, and evolve detections and the pipelines that support them, partnering with stakeholders across Security and E [... source excerpt omitted ...] rmed, data-driven decisions grounded in threat models, proactive threat hunts, and exploration of logs and telemetry. AS A STAFF SECURITY ENGINEER, THREAT DETECTION AT SNOWFLAKE, YOU WILL: Develop and deploy detections using modern engineering practices (testing and validation, CI/CD pipelines, detections as code, and a full detection development lifecycle), spanning both rules-based and AI-assisted detections. Mature our threat detection program by analyzing coverage gaps and mitigating risks through detective controls, experimenting with AI/ML approaches where they improve signal-to-noise ratio or analyst efficiency. Make data-driven recommendations for detective and preven [... source excerpt omitted ...] onse. Experience handling data programmatically (SQL, Python), ideally including large-scale log and telemetry datasets used for detection logic or analytics. Experience writing production code, including unit tests, version control, and CI/CD integration. Experience developing and operating agent-based or agentic workflows (for example, LangGraph or similar orchestration frameworks). Hands-on experience with at least one major cloud provider (AWS, Azure, or GCP) and a solid understanding of its native logging, monitoring, and security services. Familiarity with the risks that impact SaaS products and workstations, such as account compromise, data exfiltration, phishing, and s