Threat Detection Engineer II - Endpoint Security

CrowdStrike Holdings, Inc.; Sunnyvale (CA); On-site; USD 100,000 - 145,000; Full time

Benefits offered by this job

Market-leading compensation

Equity awards

Wellness programs

Generous vacation and holidays

Parental and adoption leaves

Professional development opportunities

Job summary

CrowdStrike Holdings, Inc. in Sunnyvale is seeking a seasoned detection engineer to analyze intrusions, threat campaigns, and malware, translating attacker behavior into high‑fidelity endpoint detections deployed at global scale.

You will author and optimize behavioral detection rules, query telemetry, and collaborate with threat intel and incident response teams to prioritize development while maintaining high signal‑to‑noise ratios.

Qualifications

• Bachelor's degree or 4+ years in detection engineering or endpoint security
• Experience with endpoint detection platforms or EDR tooling
• Proficiency in Windows OS internals and APIs
• PowerShell and Python for automation and analysis
• Read and understand programming languages and scripting
• Familiar with MITRE ATT&CK adversary tactics and techniques

Responsibilities

• Analyze emerging threats, campaigns, intrusion data and malware telemetry to identify detectable behaviors
• Author and optimize behavioral detection rules (IOA) for Windows endpoints
• Query and analyze endpoint telemetry to validate detection hypotheses
• Monitor detection precision and tune detections to reduce false positives
• Manage detections through development, validation, staged deployment and production monitoring
• Collaborate with threat intel and IR teams to prioritize detection development

Skills

Windows OS internals

PowerShell scripting

Python for automation

Threat analysis

EDR tooling

Telemetry analysis

Education

Bachelor's degree in information security or computer science

Tools

EDR platforms

Sandboxing

Regex tooling

Telemetry collection tooling

Job description

CrowdStrike Holdings, Inc. in Sunnyvale is seeking a seasoned detection engineer to analyze intrusions, threat campaigns, and malware, translating attacker behavior into high‑fidelity endpoint detections deployed at global scale.

You will author and optimize behavioral detection rules, query telemetry, and collaborate with threat intel and incident response teams to prioritize development while maintaining high signal‑to‑noise ratios.