Detection Engineering & SOAR Architect - SMART TECH SKILLS LLC
Overview
Senior Security Operations Analyst leads detection response and orchestration at a public sector organization. This role builds scalable AI-assisted workflows using CrowdStrike Falcon and Torq while enforcing Zero Trust principles. The ideal candidate drives detection engineering excellence and differentiates through advanced automation and governance.
What You'll Do11
- 1Serve as Tier 3 escalation point for complex security incidents performing deep-dive investigations and threat hunting across endpoint network cloud identity telemetry
- 2Conduct forensic investigations to determine attack vectors scope and preventive measures
- 3Lead incident response for high severity events coordinating with IT legal and operational leadership
- 4Mentor Tier 1 and Tier 2 analysts providing technical guidance and validating investigative work
- 5Design detection analytics dashboards and hunting queries using Falcon Query Language in CrowdStrike Falcon
- 6Tune correlation rules and detection logic to minimize false positives and improve mean time to detect
- 7Architect and maintain SOAR playbooks in Torq integrating CrowdStrike Falcon identity providers ticketing platforms and communication channels
- 8Write custom automation scripts using PowerShell Python or FQL for bespoke detections and system integrations
- 9Design AI-assisted analyst workflows using approved generative AI tools for triage summarization alert enrichment and playbook drafting
- 10Enforce strict data sanitization guardrails to protect regulated information during AI interactions
- 11Continuously evaluate emerging SOC automation and AI capabilities proposing tooling updates with risk and compliance analyses
Requirements13
- 1Bachelor's degree in Computer Science Information Security or related field
- 28 or more years progressive experience in SOC and security operations including 2+ years at Tier 3 senior analyst or detection engineering level
- 38 or more years hands-on production experience with CrowdStrike Falcon including Insight XDR Discover Fusion SOAR custom IOA authoring FQL and dashboard development
- 48 or more years experience building SOAR automation workflows using Torq preferred
- 58 or more years utilizing AI/LLM tools such as Claude or GPT-based solutions while adhering to data sanitization boundaries
- 68 or more years developing automation scripts using PowerShell Python or FQL for detections and integrations
- 78 or more years conducting forensic investigations and documenting findings hunt reports and technical runbooks
- 8Working knowledge of Zero Trust architecture principles NIST 800-207 and familiarity with IRS Pub 1075 FBI CJIS Policy HIPAA
- 9Demonstrated ability to create review and update security policies across public private and hybrid cloud contexts
- 10Relevant professional security certifications such as GIAC CrowdStrike certifications or Torq certifications
- 11Experience designing AI-assisted playbooks or analyst copilots within SOC environments while enforcing data-handling guardrails
- 12Supporting security operations in government legal or law enforcement adjacent organizations
- 13Familiarity with Microsoft Defender XDR Splunk Entra ID Protection and Tenable One CSPM tooling
Salary Insight
Salary not disclosed in listing
Location
Required Skills
Similar open positions
Explore active roles that match your skills and interests.
Conquest Consulting
VerifiedSenior SOC Detection Engineer CrowdStrike Falcon & SOAR AI
Lead detection engineering for CrowdStrike Falcon and SOAR platforms. Own and scale threat detection solutions. Drive platform improvements. Shape security operations strategy. Differentiate by delivering proactive threat intelligence.
Zoox
VerifiedSenior Information Security Engineer Detection Automation AI Zoox
We seek a Senior Information Security Engineer who designs detection systems and automates workflows. You will architect SIEM logic map detections to MITRE ATT&CK reduce false positives and build SOAR playbooks. Implement LLM‑powered triage pipelines and act as senior escalation point for incidents across AWS and on‑premise environments. This role drives security operations as code and shapes a fast‑moving team.
CrowdStrike, Inc.
VerifiedEngineer II Threat Detection - Windows (Hybrid)
CrowdStrike seeks an Engineer II to lead threat detection on Windows endpoints. This hybrid role involves analyzing emerging threats and authoring behavioral detection rules. You will collaborate across teams to mitigate intrusions and improve detection coverage at scale.
Mercor
VerifiedSecurity Operations Expert, AI Trainer & Threat Detection
Security Operations Expert builds realistic cybersecurity scenarios for AI training. You design incident response, vulnerability management, and compliance tasks that distinguish expert judgment from rote recall. Collaborate with a team at Mercor connecting elite talent with AI research labs. Own the challenge from first draft to final rubric, shaping how models learn security thinking.
Robert Half
VerifiedSecurity Analyst, Cloud Security Operations
You will own threat detection and incident response for cloud-based workloads at a growing fintech. You will triage alerts, hunt for malicious activity, and tune detections across AWS and Azure. You will partner with engineering and IT to reduce risk and improve response workflows. This role stands out for its emphasis on building detection content and automating response with Python and Splunk.
Leoforce
VerifiedSolutions Architect | Leoforce
We seek a senior-level professional to lead technical delivery and client success for enterprise cybersecurity solutions. This role blends technical leadership with stakeholder partnership and hands-on engineering. Ideal candidates have deep expertise across multiple security domains and thrive in complex problem-solving environments.