Cyber Security Engineer

Sapphire Software Solutions Inc; India; Remote; INR 1,800,000 - 2,800,000; Full time

Job summary

A tech company is seeking a highly experienced Senior Cyber Security Engineer to lead the development and optimization of advanced threat detection and response capabilities. This role focuses on endpoint, identity, cloud, and OT environments. The ideal candidate has solid experience with CrowdStrike, SOAR platforms, and cloud security while working US hours. The team will be responsible for reducing risk, driving secure architecture, and mentoring junior engineers.

Qualifications

• 5+ years in detection engineering, threat hunting, or security operations.
• Expertise in CrowdStrike ecosystem, including Falcon and Next-Gen SIEM.
• Strong proficiency in cloud security and automation tools.
• Detection engineering & automation: rule authoring/tuning, query languages, and scripting.
• Telemetry engineering & troubleshooting: sensor health and log pipelines for high-fidelity detections.

Responsibilities

• Own CrowdStrike detections—author, test, and tune in Falcon/Next-Gen SIEM/FUSION.
• Engage with SOC, Cloud, and Infrastructure teams to enhance security.
• Mentor engineers and analysts on best practices and standards.
• Engineer the telemetry pipeline with Cribl: normalize, enrich, and route data to SIEM.
• Operate the CrowdStrike stack end-to-end: sensor deployment/health, telemetry gaps, escalations.

Skills

Detection engineering

Threat hunting

Security operations

CrowdStrike Falcon

Splunk

Azure

AWS

Python

PowerShell

Log pipelines

Tools

CrowdStrike FUSION

SOAR platforms

Telemetry tools

Cribl

Job description

Overview

Role: Cyber Security Engineer/Principal Security Engineer/Senior Threat Detection Engineer

Location: 100% Remote

Contract: 1 year, Night Shift

Experience: Total at least 10+ years

Contact: Please check the JD and share your updated resume to my email [e-mail] and ping me on whatsapp [phone]) along with your resume

Required Skills & Experience

• 5+ years in detection engineering, threat hunting, or security operations.
• Endpoint & identity detection expertise—CrowdStrike Falcon/IDP preferred—plus strong proficiency in modern SIEMs (e.g., Splunk, Microsoft Sentinel, CrowdStrike “Next‑Gen SIEM”) and SOAR.
• Cloud security across AWS and/or Azure, including secure architecture and workload protections.
• Detection engineering & automation: rule authoring/tuning, query languages (FQL/CQL, KQL, SPL), and scripting (Python/PowerShell).
• Telemetry engineering & troubleshooting: sensor/agent health and log pipelines (e.g., Cribl or similar) to ensure reliable, high‑fidelity detections.

Nice to Have Skills & Experience

• Familiarity with MITRE ATT&CK, NIST 800‑53, and modern detection frameworks.
• Expertise in data pipeline optimization (Cribl or similar) for log normalization and enrichment.
• Strong background in endpoint and identity security (EDR/XDR, MFA, Conditional Access).
• Knowledge of DevSecOps practices: integrating SAST/DAST/SCA into CI/CD and detection‑as‑code workflows.
• Experience with SaaS security posture management and UEBA for cloud apps.
• Exposure to OT/xOT security and industrial network monitoring.
• Certifications such as CISSP, GIAC (GDSA/GMON/GCIA), OSCP, CCSK/CCSP, or vendor‑specific cloud/security certs.
• Familiarity with AI/ML security concepts and adversary emulation techniques.
• Threat intelligence integration: correlating IOCs, leveraging TI platforms, and supporting proactive detection.
• Secure API design and testing aligned with OWASP API Top 10.

Job Description

We are seeking a highly experienced Senior Detection Engineer to lead the development and optimization of advanced threat detection and response capabilities across endpoint, identity, cloud, SaaS, and OT/xOT environments. This role requires deep expertise in the CrowdStrike ecosystem (Falcon Endpoint, Next-Gen SIEM, Identity Protection (IDP), FUSION), SOAR platforms, and cloud security. You will serve as the CrowdStrike SME—owning sensor deployment, troubleshooting, automation, and query development—while partnering with SOC, Cloud, Infrastructure, and Application teams to measurably reduce risk and drive secure architecture and engineering initiatives. This employee will need to work US hours, specifically 8AM-5PM EST.

Key Responsibilities

• Own CrowdStrike detections—author, test, and tune in Falcon/Next‑Gen SIEM/FUSION; leverage IDP for identity attacks.
• Hunt and validate using FQL/CQL; measure detection fidelity and reduce false positives.
• Build cloud detections for AWS/Azure/GCP and integrate cloud‑native logs and controls.
• Engineer the telemetry pipeline with Cribl: normalize, enrich, and route data to SIEM.
• Operate the CrowdStrike stack end‑to‑end: sensor deployment/health, telemetry gaps, escalations; engage CrowdStrike support.
• Design SOAR automations and safe containment to shrink MTTD/MTTR; integrate with IR/compliance workflows.
• Translate MITRE ATT&CK and threat models into prioritized detection use cases and playbooks.
• Partner with Infra/Cloud/SOC to harden endpoints, identity, and M365/SaaS security configurations.
• Lead OT/xOT visibility and low‑impact rollout of detections where applicable.
• Mentor engineers/analysts and maintain standards, runbooks, and incident playbooks.