Senior Detection and Incident Response Engineer

InvestCloud, Inc.; United States; On-site; USD 175,000 - 180,000; Full time

Benefits offered by this job

Medical/Dental/Vision

401(k) with company match

Paid time off

Employee assistance program

Job summary

InvestCloud, Inc. seeks a Senior Detection and Incident Response Engineer to own CrowdStrike Falcon end-to-end, design robust logging for full visibility, and build automation that detects, contains, and remediates threats at machine speed without business disruption.

You will lead incident response, manage the MDR partner, and mentor engineers in the US and India, using strong scripting and SIEM expertise to map detections to MITRE ATT&CK.

Qualifications

• Eight or more years in detection engineering and incident response.
• Expert-level CrowdStrike Falcon administration and SOAR workflows.
• Experience with MDR, XDR, MSSPs, and incident containment.
• Strong logging knowledge across Windows, Linux, and cloud.
• Scripting skills in Python or PowerShell and API automation.
• Experience with SIEM platforms such as Splunk or MS Sentinel.
• Familiarity with MITRE ATT&CK mapping for detections.

Responsibilities

• Own CrowdStrike Falcon platform end to end including policy and tagging.
• Design detection coverage across endpoints, identity, cloud, and network.
• Build automation to detect, contain, and remediate threats quickly.
• Lead technical incident response from first alert to closure.
• Manage MDR partner and ensure measurable service levels.
• Analyze logs to confirm malicious activity and write playbooks.

Skills

CrowdStrike Falcon administration

MDR/XDR knowledge

Windows/Linux logs

Python/PowerShell

SIEM experience

MITRE ATT&CK knowledge

Calm communication

Tools

Falcon Fusion SOAR

Real Time Response

Falcon APIs

Splunk

Microsoft Sentinel

Job description

We are looking for a Senior Detection and Incident Response Engineer who can see an attack anywhere and stop it fast. You will own CrowdStrike, design the logging and monitoring that gives us complete visibility, and build automation that detects, contains, and remediates threats at machine speed without disrupting the business. When a real incident happens, you will lead the response with precision and keep leadership informed.

How You Will Provide Meaningful Contributions

• Own the CrowdStrike Falcon platform end to end, including policy, tuning, host tagging and grouping, Real Time Response, and Falcon Fusion workflows.
• Design detection coverage across endpoints, identity, cloud, network, firewall, email, and SaaS applications, and close the gaps that remain.
• Build automation that detects, contains, and remediates threats in seconds, with safeguards that prevent unintended business disruption.
• Lead technical incident response from first alert to closure, including containment, investigation, evidence, and lessons learned.
• Manage our managed detection and response (MDR) provider, tune its detections, and hold it to measurable service levels.
• Analyze system, firewall, identity, and application logs to find and confirm malicious activity.
• Write and test incident response playbooks, and run exercises with technical and business teams.
• Lead and develop detection and response engineers in the U.S. and India, and take part in the on-call rotation.

What Success Looks Like In Your First Year

• We can see an attack in any part of our environment, and we know exactly where any remaining blind spots are and how we will close them.
• Common threats are detected and contained automatically, in seconds, without breaking anything the business depends on.
• Serious incidents are contained quickly and precisely, with clear updates to leadership.
• CrowdStrike and our managed detection partner are tuned and held to measurable results.

Basic Qualifications For Consideration

• Eight or more years of experience in detection engineering and incident response, including leading the response to real incidents.
• Expert-level CrowdStrike Falcon administration, including Falcon Fusion security orchestration, automation, and response (SOAR) workflows, Real Time Response, host grouping and tagging, and the Falcon APIs.
• Expert experience with managed detection and response (MDR), extended detection and response (XDR), and managed security service providers (MSSPs).
• Deep knowledge of Windows and Linux system logs, firewall logs, identity logs, and cloud audit logs, and how to use them to find an attacker.
• Strong scripting skills in Python, PowerShell, or similar, and experience automating through APIs.
• Experience with a security information and event management (SIEM) platform such as CrowdStrike Falcon Next-Gen SIEM, Splunk, or Microsoft Sentinel.
• Working knowledge of MITRE ATT&CK and how to map detection coverage to it.
• Calm, clear communication during high-pressure incidents.

Preferred Qualifications

• Digital forensics experience or certifications such as GCIH, GCFA, or GNFA.
• Experience in financial services or another regulated industry.
• Experience with anti-ransomware or deception technologies.

Who You Are

• You hold yourself to a world-class standard, and it shows in everything you deliver.
• You are a self-starter. You find the work that matters and finish it without being asked.
• You care about this field beyond the job description. You keep learning and building on your own because you enjoy it, and you put in the extra effort when the mission calls for it.
• You bring drive, ambition, and a positive attitude to hard problems.
• You make the people around you better. You share what you know, you never make anyone feel small, and you let your work speak for itself.

How We Work

Our security team spans the United States, Romania, and India and protects the platforms that banks and wealth managers rely on every day. We hold a high bar, and we hold it together. The people on this team own their work from start to finish, keep learning because they want to, and make the people around them better. We do not reward the loudest voice in the room. We reward the best work, delivered with respect for the people it affects.

About InvestCloud

InvestCloud, a global leader in wealth technology, aspires to enable a smarter financial future. Driving the digital transformation of the wealth management industry, the company serves a broad array of clients globally, including Wealth and Asset Managers, Wirehouses, Banks, RIAs, and Insurers. In terms of scale, the company’s clients represent more than 40 percent of the $132 trillion of total assets globally. As a leader in delivering personalization and scale across advisory programs, including unified managed accounts (UMA) and separately managed accounts (SMA), the company is committed to the success of its clients. By equipping and enabling advisors and their clients with connected technology, enhanced intelligence, and inspired experiences, InvestCloud delivers leading digital wealth management and financial planning solutions, complemented by a dynamic data warehouse, which scale across the complete wealth continuum. In 2026, InvestCloud was named CNBC World’s Top Fintech Company, a proof point of the company’s commitment to innovation and client success. Headquartered in the United States, InvestCloud serves clients around the world. For more information, visit InvestCloud.com.

Our Values

• Client Connected
• Human Centered
• Technology Forward
• Respect + Integrity
• Excellence

Salary range: $175,000 - $180,000. Benefits include medical/Rx, dental, vision, disability, and life/AD&D insurance plans, Flexible Savings Account (FSA), Health Savings Account (HSA), Employee Assistance Plan (EAP), health advocacy, voluntary ancillary plans (accident, critical illness, hospital indemnity, legal, identity theft, auto/home, and pet insurance), 401(k) retirement savings plan with company match, and paid time off.