Detection & Response Engineer – Analysis & Platform Enablement

Pro5.ai; Philippines; On-site; PHP 1,200,000 - 1,600,000; Full time

Job summary

Pro5.ai is seeking an experienced Detection & Response Engineer to join its Risk Operations team. This individual-contributor role blends security investigations, detection engineering, and platform enablement across SOC, Product, Engineering, CTI, GRC, and customer delivery teams.

You will turn validated investigative methods into reusable workflows, develop detection content, and collaborate to build scripts, API integrations, and workflow components.

Qualifications

• 5+ years of security experience, with at least 2 years building and tuning detection logic.
• Proficiency with CrowdStrike Falcon Next-Gen SIEM including CQL.
• Hands-on experience with Falcon Fusion SOAR workflows.
• Practical Python experience and REST/JSON skills.
• Familiarity with PowerShell and secure credential management.
• Knowledge of MITRE ATT&CK and Windows/Linux event data.
• Experience with version control, peer review, and regression testing.
• Strong investigation judgment and cross-functional collaboration.

Responsibilities

• Investigate security cases and perform threat hunts using CrowdStrike tools.
• Develop, test, deploy, tune, and maintain detection logic and dashboards.
• Build and maintain Falcon Fusion SOAR workflows and automation.
• Translate investigations into platform workflow specs and scripts.
• Collaborate with Product and Engineering on analyst-facing features.
• Validate telemetry coverage and troubleshoot parsing/normalization.
• Test detections against representative cases and monitor outcomes.
• Provide technical support and coaching to teams.

Skills

Security investigations

Threat hunting

Detection engineering

Python

PowerShell

REST APIs

JSON

Scripting

Cross-functional collaboration

Tools

CrowdStrike Falcon Next-Gen SIEM

CrowdStrike Falcon Fusion SOAR

FalconPy

Python

Git / Version control

Job description

Our client is looking for an experienced Detection & Response Engineer to join its Risk Operations team.

This is an individual-contributor role combining hands-on security investigations, detection engineering, and internal platform enablement. You will turn validated investigative methods into reusable and tested security workflows while collaborating with SOC, Product, Engineering, Cyber Threat Intelligence (CTI), Governance, Risk and Compliance (GRC), and customer-delivery teams.

Key Responsibilities

Security Investigations and Threat Hunting

• Investigate security cases and conduct targeted hunts using CrowdStrike Falcon Next-Gen SIEM and CQL.
• Correlate telemetry from multiple sources, assess scope and impact, document findings, and recommend appropriate actions.

Detection Engineering

• Develop, test, deploy, tune, and maintain detection logic, queries, dashboards, and analyst guides.
• Maintain version-controlled detection content and support its ongoing improvement.

SOAR and Workflow Automation

• Build and maintain Falcon Fusion SOAR workflows for enrichment, evidence capture, routing, escalation, and authorized response.
• Translate validated investigations into platform workflow specifications.
• Collaborate with Product and Engineering to develop scripts, API integrations, workflow components, and prototypes.

Telemetry and Platform Enablement

• Validate telemetry coverage and quality.
• Troubleshoot parsing, normalization, mapping, and source-data issues.
• Test detections and workflows against representative cases.
• Monitor outcomes, exceptions, and production feedback.
• Document workflow ownership and support handoffs.

Technical Support and Collaboration

• Provide technical support, troubleshooting, knowledge transfer, and coaching.
• Coordinate assigned analysis and platform work with relevant teams.

Requirements

• 5+ years of relevant security experience, including at least 2 years developing, testing, and tuning detection logic, or equivalent demonstrated capability.
• Production proficiency with CrowdStrike Falcon Next-Gen SIEM, including CQL, cross-source investigations, detection content, telemetry interpretation, and tuning.
• Hands-on experience with Falcon Fusion SOAR workflows.
• Practical experience using Charlotte AI, including evidence verification and awareness of approval boundaries.
• Practical Python experience.
• Experience with REST/Falcon APIs, JSON, authentication, error handling, and secure credential management.
• Familiarity with PowerShell or another relevant scripting language.
• Experience with telemetry onboarding and parser/normalization troubleshooting.
• Knowledge of MITRE ATT&CK and Windows/Linux event data.
• Experience with controlled changes, version control, peer review, and regression testing.
• Strong investigation judgment, documentation, communication, and cross-functional collaboration skills.

Nice to Have

• Experience converting SOC runbooks or manual analysis into production workflows or internal security platforms.
• CrowdStrike resident, responder, partner implementation, or customer-embedded Falcon experience.
• Experience with FalconPy or comparable API tooling.
• Experience working with Product and Engineering on analyst-facing features, case lifecycle integration, acceptance testing, or iterative delivery.
• Managed security services, multi-client, or follow-the-sun SOC operations experience.
• Familiarity with ITSM integrations such as ServiceNow or Jira.
• Relevant CrowdStrike training or credentials, GIAC certifications, or related qualifications.