Description

You lead Tier 3 escalations, complex incident investigations, and detection engineering within a SOC environment.

This role is on-site.

Responsibilities

• Perform deep-dive threat hunting and root cause analysis across endpoint, network, cloud, and identity telemetry.
• Design, build, and maintain detection analytics and dashboards using CrowdStrike Falcon and FQL.
• Architect and maintain SOAR playbooks in Torq to automate response workflows.
• Lead incident response for high-severity events and mentor Tier 1/Tier 2 analysts.
• Develop AI-assisted analyst workflows and ensure strict adherence to data sanitization and compliance.

Required Skills

• 8+ years of progressive SOC or security operations experience.
• 2+ years at a Tier 3, senior analyst, or detection engineering level.
• Hands-on production experience with CrowdStrike Falcon (Insight XDR, Discover, Fusion SOAR).
• Proficiency in Falcon Query Language (FQL) for custom detection and IOA authoring.
• Experience building or maintaining SOAR automation, with Torq preferred.
• Practical experience using AI/LLM tools in security operations with safe-use boundaries.
• Strong scripting skills in PowerShell, Python, or FQL-based automation.
• Working knowledge of Zero Trust architecture (NIST 800-207) and regulatory frameworks (IRS Pub. 1075, FBI CJIS, HIPAA).

Preferred Skills

• Bachelor's degree in Computer Science, Information Security, or related field.
• GIAC certification.

Key Skills

Education

Bachelor's degree