Senior SOC Detection Engineer – CrowdStrike Falcon, SOAR, AI

Job not on LinkedIn

🔥 0 minutes ago

🤠 Texas – Remote

🤠 Texas – Remote

⏰ Full Time

🟠 Senior

🤖 Artificial Intelligence

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

BizTech Fusion

WebsiteLinkedInAll Job Openings

2 - 10 employees

Founded 2022

💼 Consulting

🤝 B2B

🔒 Cybersecurity

Consulting • B2B • Cybersecurity

BizTech Fusion is an agile IT consulting and professional services firm that delivers Microsoft-focused modern work, unified communications, network engineering, cybersecurity, and managed IT services to businesses and government clients. The company provides application and software development (web and mobile), endpoint protection, Windows Autopilot, Microsoft Teams Phone and collaboration solutions, program and project management, talent acquisition/staff augmentation, and value-added reseller/managed support offerings. BizTech Fusion holds government contracting credentials and regional DBE/MBE classifications, operates offices in Washington, DC and Columbia, MD, and is a Microsoft Solutions Partner with a Microsoft Teams specialization.

📋 Description

• Serve as a Tier 3 SOC escalation point for complex security incidents • Perform advanced investigations, threat hunting, and root cause analysis • Design, develop, and maintain CrowdStrike Falcon detection logic and analytics • Create and optimize FQL queries, dashboards, and hunting workflows • Build and maintain SOAR automation playbooks using Torq and related security tools • Develop AI-assisted security workflows for analyst productivity • Lead incident response activities for high-severity cybersecurity events • Create security documentation, runbooks, SOPs, and investigation reports • Mentor Tier 1 and Tier 2 SOC analysts • Evaluate emerging security automation and AI capabilities • Participate in critical incident escalation support

🎯 Requirements

• Senior-level SOC, Detection Engineering, or Security Operations experience • Minimum 2+ years of experience supporting government, legal, or law-enforcement-adjacent security environments • Experience working at a Tier 3 SOC Analyst or Detection Engineer level • Strong incident response, threat hunting, and forensic investigation experience • Strong written and verbal communication skills • Ability to work independently and collaborate with security, IT, and business teams • Strong hands-on experience with the CrowdStrike Falcon platform • Experience with Falcon Insight XDR, Discover, and/or Fusion SOAR • Experience creating custom detections and Indicators of Attack (IOA) • Strong experience with Falcon Query Language (FQL) • Experience developing detection analytics, dashboards, and hunting queries • Experience tuning alerts and improving detection accuracy • Experience handling complex security incidents and Tier 3 escalations • Advanced threat hunting experience across endpoint, network, cloud, and identity telemetry • Root cause analysis and forensic investigation experience • Experience with security monitoring, alert tuning, and investigation workflows • Experience creating hunt reports, incident reports, runbooks, and SOP documentation • Experience designing and maintaining SOAR playbooks • Strong experience with security automation workflows • Experience integrating security tools, ticketing systems, identity platforms, and communication platforms • Practical experience using AI/LLM tools such as Claude, GPT-based tools, or other enterprise-approved AI assistants • Experience using AI tools for alert triage acceleration, security investigation support, playbook generation, detection engineering assistance, analyst workflow automation, and security documentation • Understanding of secure AI usage practices, including data sanitization and protection of sensitive information • Strong scripting and automation skills using Python and PowerShell • Knowledge of Zero Trust Architecture principles (NIST 800-207) • Familiarity with IRS Pub. 1075, FBI CJIS Policy, and HIPAA • Experience with Microsoft Defender XDR, Splunk, Entra ID Protection, and Tenable One/CSPM platforms • Bachelor’s degree in Computer Science, Information Security, Cybersecurity, or related field preferred • Equivalent professional experience will also be considered • Torq SOAR experience is highly preferred • GCIH, GCIA, GCFA, CCFR, CCFA, or Torq certifications are highly preferred

🏖️ Benefits

• 12+ month extendable duration • Remote work (Texas only) • Professional certifications highly preferred, including GCIH, GCIA, GCFA, CCFR, CCFA, and Torq Certification