Threat Detection Engineer II (Windows) - Hybrid

CrowdStrike Holdings, Inc.; New York (NY); Hybrid; USD 100,000 - 145,000; Full time

Benefits offered by this job

Equity awards

Health insurance

Paid time off

Parental leave

Professional development

Job summary

CrowdStrike Holdings, Inc. is seeking an Engineer II for Threat Detection on Windows in a hybrid role. You will analyze intrusions, author detection rules, and validate telemetry across endpoints to improve Falcon sensor coverage.

The role requires CJIS eligibility, a degree or equivalent experience, and strong Windows security skills. You will collaborate with threat intel and IR teams while working 2–3 days onsite.

Qualifications

• Bachelor's degree in information security, computer science, or related field or 4+ years of relevant experience.
• Experience with endpoint detection platforms, EDR tooling, or detection-driven workflows.
• Proficiency in Windows OS internals, APIs, and security concepts.

Responsibilities

• Analyze emergent threats, campaigns, and malware to identify detectable behaviors.
• Author and optimize behavioral detection rules (IOA) for Windows endpoints.
• Query endpoint telemetry to validate hypotheses and assess coverage.
• Tune detections to maintain high signal-to-noise ratios.
• Manage detections across development, validation, deployment and monitoring.
• Collaborate with threat intel and incident response to prioritize work.

Skills

EDR tooling

Windows internals

Behavioral malware analysis

Regex proficiency

PowerShell

Python scripting

Telemetry analysis

Threat intelligence

Detection engineering

AI-assisted tooling

Education

Bachelor's degree in information security or computer science

Tools

Sandboxing

Job description

CrowdStrike Holdings, Inc. is seeking an Engineer II for Threat Detection on Windows in a hybrid role. You will analyze intrusions, author detection rules, and validate telemetry across endpoints to improve Falcon sensor coverage.

The role requires CJIS eligibility, a degree or equivalent experience, and strong Windows security skills. You will collaborate with threat intel and IR teams while working 2–3 days onsite.