At TechBiz Global, we are providing recruitment service to our TOP clients from our portfolio. We are currently seeking a Detection & Response Engineer to join one of our clients' teams. If you're looking for an exciting opportunity to grow in a innovative environment, this could be the perfect fit for you.
Key Responsibilities:
Investigate security cases and targeted hunts using CrowdStrike Falcon Next-Gen SIEM and CQL; correlate telemetry, assess scope and impact, document findings, and recommend appropriate actions.
Develop, test, deploy, tune, and maintain detection logic, queries, dashboards, analyst guides, and version-controlled detection content.
Build and maintain Falcon Fusion SOAR workflows for enrichment, evidence capture, routing, escalation, and authorized response.
Validate telemetry coverage and quality; troubleshoot parsing, normalization, mapping, and source-data issues.
Translate validated investigations into platform workflow specifications and co-build scripts, API integrations, workflow components, and prototypes with Product and Engineering.
Test workflows and detections against representative cases; monitor outcomes, exceptions, and production feedback, and document ownership and support handoffs.
Provide technical support, troubleshooting, knowledge transfer, and coaching; coordinate assigned analysis and platform work.
Must have:
5+ years of relevant security experience, including at least 2 years developing, testing, and tuning detection logic, or equivalent demonstrated capability.
Production proficiency with CrowdStrike Falcon Next-Gen SIEM, including CQL, cross-source investigations, detection content, telemetry interpretation, and tuning.
Hands-on Falcon Fusion SOAR workflow experience and practical use of Charlotte AI with evidence verification and awareness of approval boundaries.
Practical Python, REST/Falcon APIs, JSON, authentication, error handling, and secure credential management; familiarity with PowerShell or another relevant scripting language.
Experience with telemetry onboarding, parser/normalization troubleshooting, MITRE ATT&CK, Windows/Linux events, and controlled changes, version control, peer review, and regression testing.
Strong investigation judgment, defensible documentation, communication, and cross-functional collaboration skills.
Nice to have:
Experience converting SOC runbooks or manual analysis into production workflows or internal security platforms.
CrowdStrike resident, responder, partner implementation, or customer-embedded Falcon experience; FalconPy or comparable API tooling.
Experience partnering with Product and Engineering on analyst-facing features, case lifecycle integration, acceptance testing, or iterative delivery.
Managed security services, multi-client or follow-the-sun SOC operations, and ITSM integrations such as ServiceNow or Jira.
Relevant CrowdStrike training or credentials, GIAC invest
Job details are sourced from the employer's original posting.
Open job postingAbout the company
A global technology business solutions provider.