Detection & Response Engineer

TechBiz Global

. Investigate security cases and targeted hunts using CrowdStrike Falcon Next-Gen SIEM and CQL .

Posted 11/11/2026full-timeRemote • RomaniaMid-LevelSeniorWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive experience in security investigations and detection logic development, with proficiency in CrowdStrike Falcon Next-Gen SIEM and Falcon Fusion SOAR workflows. Capable of translating investigations into actionable workflows and providing technical support and coaching.

Highest-signal resume keywords

CrowdStrike Falcon Next-Gen SIEMDetection Logic DevelopmentFalcon Fusion SOAR WorkflowsPython ProgrammingMITRE ATT&CK Familiarity

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Detection LogicCQLTelemetry InterpretationJSONREST/Falcon APIsPowerShellParser TroubleshootingVersion ControlRegression TestingCross-Source Investigations

Soft Skills

Investigation JudgmentDefensible DocumentationCommunicationCross-Functional Collaboration

Tools & Technologies

CrowdStrike FalconFalcon FusionCharlotte AIServiceNowJira

Certifications & Qualifications

CrowdStrike TrainingGIAC

Industry Keywords

Security Operations Center (SOC)Telemetry OnboardingEvidence VerificationControlled ChangesMulti-Client Operations

Tech Stack

Tools & technologies

ITSMLinuxPythonServiceNow

About the role

Key responsibilities & impact

Investigate security cases and targeted hunts using CrowdStrike Falcon Next-Gen SIEM and CQL
Correlate telemetry, assess scope and impact, document findings, and recommend appropriate actions
Develop, test, deploy, tune, and maintain detection logic, queries, dashboards, analyst guides, and version-controlled detection content
Build and maintain Falcon Fusion SOAR workflows for enrichment, evidence capture, routing, escalation, and authorized response
Validate telemetry coverage and quality; troubleshoot parsing, normalization, mapping, and source-data issues
Translate validated investigations into platform workflow specifications and co-build scripts, API integrations, workflow components, and prototypes with Product and Engineering
Test workflows and detections against representative cases; monitor outcomes, exceptions, and production feedback
Document ownership and support handoffs
Provide technical support, troubleshooting, knowledge transfer, and coaching
Coordinate assigned analysis and platform work

Requirements

What you’ll need

5+ years of relevant security experience, including at least 2 years developing, testing, and tuning detection logic, or equivalent demonstrated capability
Production proficiency with CrowdStrike Falcon Next-Gen SIEM, including CQL, cross-source investigations, detection content, telemetry interpretation, and tuning
Hands-on Falcon Fusion SOAR workflow experience and practical use of Charlotte AI with evidence verification and awareness of approval boundaries
Practical Python, REST/Falcon APIs, JSON, authentication, error handling, and secure credential management
Familiarity with PowerShell or another relevant scripting language
Experience with telemetry onboarding, parser/normalization troubleshooting, MITRE ATT&CK, Windows/Linux events, controlled changes, version control, peer review, and regression testing
Strong investigation judgment, defensible documentation, communication, and cross-functional collaboration skills
Nice to have: Experience converting SOC runbooks or manual analysis into production workflows or internal security platforms
Nice to have: CrowdStrike resident, responder, partner implementation, or customer-embedded Falcon experience; FalconPy or comparable API tooling
Nice to have: Experience partnering with Product and Engineering on analyst-facing features, case lifecycle integration, acceptance testing, or iterative delivery
Nice to have: Managed security services, multi-client or follow-the-sun SOC operations, and ITSM integrations such as ServiceNow or Jira
Nice to have: Relevant CrowdStrike training or credentials, GIAC