Senior Detection and Incident Response Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Take full ownership of the CrowdStrike Falcon platform, overseeing policy management, tuning, host tagging and grouping, Real Time Response, and Falcon Fusion workflows.

• Create detection strategies across endpoints, identities, cloud services, networks, firewalls, emails, and SaaS applications.

• Develop automation solutions that identify, contain, and remediate threats in seconds, while minimizing unintended business interruptions.

• Direct technical incident response from initial alert to resolution, including containment, investigation, evidence collection, and post-incident reviews.

• Oversee the managed detection and response (MDR) provider, refine detections, and uphold measurable service standards.

• Examine system, firewall, identity, and application logs to identify and validate malicious activities.

• Draft and evaluate incident response playbooks, conducting drills with technical and business teams.

• Mentor and lead detection and response engineers based in the U.S. and India.

• Participate in the on-call duty rotation.

• Keep leadership updated during critical incidents.

⛳️ Requirements

• A minimum of eight years of experience in detection engineering and incident response, including leading real-life incident responses.

• Proficient in CrowdStrike Falcon administration, encompassing Falcon Fusion SOAR workflows, Real Time Response, host grouping and tagging, as well as Falcon APIs.

• Extensive experience with managed detection and response (MDR), extended detection and response (XDR), and managed security service providers (MSSPs).

• In-depth knowledge of Windows and Linux system logs, firewall logs, identity logs, and cloud audit logs.

• Strong scripting capabilities in Python, PowerShell, or similar languages, along with experience in automating processes via APIs.

• Familiarity with a SIEM platform such as CrowdStrike Falcon Next-Gen SIEM, Splunk, or Microsoft Sentinel.

• Working knowledge of MITRE ATT&CK and the ability to map detection coverage accordingly.

• Ability to communicate calmly and clearly during high-pressure situations.

• Preferred: Experience or certifications in digital forensics, such as GCIH, GCFA, or GNFA.

• Preferred: Background in financial services or other regulated sectors.

• Preferred: Experience with anti-ransomware or deception technologies.

🏝️ Benefits

• Medical/Rx insurance

• Dental insurance

• Vision insurance

• Disability insurance

• Life/AD&D insurance plans

• Flexible Savings Account (FSA)

• Health Savings Account (HSA)

• Employee Assistance Plan (EAP)

• Health advocacy

• Voluntary ancillary plans: accident, critical illness, hospital indemnity, legal, identity theft, auto/home, and pet insurance

• 401(k) retirement savings plan with company match

• Paid time off