Detection & Response Engineer
TechBiz Global GmbH15 hours ago
Remote, WorldwideSenior
Responsibilities
- Investigate security cases and targeted hunts using CrowdStrike Falcon Next-Gen SIEM and CQL.
- Correlate telemetry, assess scope and impact, document findings, and recommend appropriate actions.
- Develop, test, deploy, tune, and maintain detection logic, queries, dashboards, analyst guides, and detection content.
- Build and maintain Falcon Fusion SOAR workflows for enrichment, evidence capture, routing, escalation, and authorized response.
- Validate telemetry coverage and quality and troubleshoot parsing, normalization, mapping, and source-data issues.
- Translate investigations into workflow specifications and co-build scripts, API integrations, workflow components, and prototypes with Product and Engineering.
- Test workflows and detections against representative cases and monitor outcomes, exceptions, and production feedback.
- Provide technical support, troubleshooting, knowledge transfer, coaching, and coordination of assigned analysis and platform work.
Requirements
- 5+ years of relevant security experience, including at least 2 years developing, testing, and tuning detection logic, or equivalent demonstrated capability.
- Production proficiency with CrowdStrike Falcon Next-Gen SIEM, including CQL, cross-source investigations, detection content, telemetry interpretation, and tuning.
- Hands-on experience with Falcon Fusion SOAR workflows and practical use of Charlotte AI with evidence verification and awareness of approval boundaries.
- Practical Python, REST/Falcon APIs, JSON, authentication, error handling, and secure credential management experience.
- Familiarity with PowerShell or another relevant scripting language.
- Experience with telemetry onboarding, parser and normalization troubleshooting, MITRE ATT&CK, Windows/Linux events, controlled changes, version control, peer review, and regression testing.
- Strong investigation judgment, defensible documentation, communication, and cross-functional collaboration skills.
- Experience converting SOC runbooks or manual analysis into production workflows or internal security platforms is preferred.
- CrowdStrike resident, responder, partner implementation, or customer-embedded Falcon experience and FalconPy or comparable API tooling are preferred.
- Experience partnering with Product and Engineering on analyst-facing features, case lifecycle integration, acceptance testing, or iterative delivery is preferred.
- Managed security services, multi-client or follow-the-sun SOC operations, ITSM integrations such as ServiceNow or Jira, relevant CrowdStrike training or credentials, and GIAC credentials are preferred.
About TechBiz Global GmbH
TechBiz Global GmbH provides IT recruitment, outstaffing, and custom software development for startups and enterprises, plus consulting around product building and scaling. The privately held company is headquartered in Berlin and was founded in 2021. It staffs engineering roles for clients and delivers outsourced development teams, supporting engagements across multiple countries.