Senior Detection and Incident Response Engineer

InvestCloudOct2024; United States; À distance; USD 175 000 - 180 000; Plein temps

Résumé du poste

InvestCloud is seeking a Senior Detection and Incident Response Engineer to own the CrowdStrike Falcon platform and drive end-to-end detection, containment, and remediation across the environment. You will lead incident response, coordinate with MDR partners, and guide teams in the U.S. and India.

The role requires 8+ years in detection engineering, strong scripting, and SIEM experience. Travel for on-call rotations may be involved, with a focus on rapid, precise disruption of threats while

Qualifications

• Eight or more years of detection engineering and incident response experience.
• Expert-level CrowdStrike Falcon administration including SOAR, Real Time Response, and APIs.
• Experience with MDR/XDR, MSSPs, and Windows/Linux log analysis.

Responsabilités

• Own CrowdStrike Falcon platform end to end, including policy, tuning, tagging, and workflows.
• Design detection coverage across endpoints, identity, cloud, network, and SaaS apps.
• Build automation that detects, contains, and remediates threats quickly.
• Lead technical incident response from first alert to closure with containment and evidence gathering.
• Manage MDR provider, tune detections, and ensure measurable service levels.
• Analyze system, firewall, identity, and app logs to find malicious activity.
• Write and test incident response playbooks and run exercises with teams.
• Lead and develop detection engineers in the U.S. and India and participate in on-call rotation.

Connaissances

Scripting (Python/PowerShell)

Incident response leadership

Threat detection

Communication with leadership

Outils

CrowdStrike Falcon

Splunk

Microsoft Sentinel

Description du poste

Senior Detection and Incident Response Engineer

Job Category : Operations Management

Requisition Number : SENIO003361

• Posted : October 20, 2026
• Full-Time
• Remote

Locations

Showing 1 location

US Anywhere Remote

Description

We are looking for a Senior Detection and Incident Response Engineer who can see an attack anywhere and stop it fast. You will own CrowdStrike, design the logging and monitoring that gives us complete visibility, and build automation that detects, contains, and remediates threats at machine speed without disrupting the business. When a real incident happens, you will lead the response with precision and keep leadership informed.

How you will provide meaningful contributions

• Own the CrowdStrike Falcon platform end to end, including policy, tuning, host tagging and grouping, Real Time Response, and Falcon Fusion workflows.
• Design detection coverage across endpoints, identity, cloud, network, firewall, email, and SaaS applications, and close the gaps that remain.
• Build automation that detects, contains, and remediates threats in seconds, with safeguards that prevent unintended business disruption.
• Lead technical incident response from first alert to closure, including containment, investigation, evidence, and lessons learned.
• Manage our managed detection and response (MDR) provider, tune its detections, and hold it to measurable service levels.
• Analyze system, firewall, identity, and application logs to find and confirm malicious activity.
• Write and test incident response playbooks, and run exercises with technical and business teams.
• Lead and develop detection and response engineers in the U.S. and India, and take part in the on-call rotation.

What success looks like in your first year

• We can see an attack in any part of our environment, and we know exactly where any remaining blind spots are and how we will close them.
• Common threats are detected and contained automatically, in seconds, without breaking anything the business depends on.
• Serious incidents are contained quickly and precisely, with clear updates to leadership.
• CrowdStrike and our managed detection partner are tuned and held to measurable results.

Basic qualifications for consideration

• Eight or more years of experience in detection engineering and incident response, including leading the response to real incidents.
• Expert-level CrowdStrike Falcon administration, including Falcon Fusion security orchestration, automation, and response (SOAR) workflows, Real Time Response, host grouping and tagging, and the Falcon APIs.
• Expert experience with managed detection and response (MDR), extended detection and response (XDR), and managed security service providers (MSSPs).
• Deep knowledge of Windows and Linux system logs, firewall logs, identity logs, and cloud audit logs, and how to use them to find an attacker.
• Strong scripting skills in Python, PowerShell, or similar, and experience automating through APIs.
• Experience with a security information and event management (SIEM) platform such as CrowdStrike Falcon Next-Gen SIEM, Splunk, or Microsoft Sentinel.
• Working knowledge of MITRE ATT&CK and how to map detection coverage to it.

Preferred qualifications

• Digital forensics experience or certifications such as GCIH, GCFA, or GNFA.
• Experience in financial services or another regulated industry.
• Experience with anti-ransomware or deception technologies.

Who you are

• You hold yourself to a world-class standard, and it shows in everything you deliver.
• You are a self-starter. You find the work that matters and finish it without being asked.
• You care about this field beyond the job description. You keep learning and building on your own because you enjoy it, and you put in the extra effort when the mission calls for it.
• You bring drive, ambition, and a positive attitude to hard problems.
• You make the people around you better. You share what you know, you never make anyone feel small, and you let your work speak for itself.

How we work

Our security team spans the United States, Romania, and India and protects the platforms that banks and wealth managers rely on every day. We hold a high bar, and we hold it together. The people on this team own their work from start to finish, keep learning because they want to, and make the people around them better. We do not reward the loudest voice in the room. We reward the best work, delivered with respect for the people it affects.

About InvestCloud

InvestCloud, a global leader in wealth technology, aspires to enable a smarter financial future. Driving the digital transformation of the wealth management industry, the company serves a broad array of clients globally, including Wealth and Asset Managers, Wirehouses, Banks, RIAs, and Insurers. In terms of scale, the company’s clients represent more than 40 percent of the $132 trillion of total assets globally. As a leader in delivering personalization and scale across advisory programs, including unified managed accounts (UMA) and separately managed accounts (SMA), the company is committed to the success of its clients. By equipping and enabling advisors and their clients with connected technology, enhanced intelligence, and inspired experiences, InvestCloud delivers leading digital wealth management and financial planning solutions, complemented by a dynamic data warehouse, which scale across the complete wealth continuum. In 2026, InvestCloud was named CNBC World’s Top Fintech Company, a proof point of the company’s commitment to innovation and client success. Headquartered in the United States, InvestCloud serves clients around the world. For more information, visit InvestCloud.com .

Our Values

• Client Connected
• Human Centered
• Respect + Integrity

The actual salary will vary based on applicant’s education, experience, skills, and abilities, as well as internal equity and alignment with market data. The salary may also be adjusted based on the applicant’s geographic location. Salary range: $175,000 - $180,000. Benefits include medical/Rx, dental, vision, disability, and life/AD&D insurance plans, Flexible Savings Account (FSA), Health Savings Account (HSA), Employee Assistance Plan (EAP), health advocacy, voluntary ancillary plans (accident, critical illness, hospital indemnity, legal, identity theft, auto/home, and pet insurance), 401(k) retirement savings plan with company match, and paid time off.

#LI-HJ1

Equal Opportunity Employer
This employer is required to notify all applicants of their rights pursuant to federal employment laws.For further information, please review the Know Your Rights notice from the Department of Labor.