Senior SOC Detection Engineer – CrowdStrike Falcon & SOAR / AI

Senior SOC Detection Engineer – CrowdStrike Falcon & SOAR / AI

Company: BizTech Fusion

Location: Remote (Texas Only)

Duration: 12+ Months (Extendable)

Experience: Senior-Level Security Operations Professional

About the Role

BizTech Fusion is seeking a Senior SOC Detection Engineer – CrowdStrike Falcon & SOAR / AI for one of our valued clients. This is a senior-level cybersecurity role focused on advanced SOC operations, detection engineering, incident response, threat hunting, security automation, and AI-assisted security operations.

The ideal candidate will have deep hands-on experience with CrowdStrike Falcon, SOAR automation, Falcon Query Language (FQL), threat hunting, detection analytics, and incident response. The candidate should also have practical experience leveraging AI/LLM tools to improve security operations workflows while maintaining strict security and data-handling standards.

Required Qualifications

• Senior-level SOC, Detection Engineering, or Security Operations experience.
• Minimum 2+ years of experience supporting government, legal, or law-enforcement-adjacent security environments.
• Experience working at a Tier 3 SOC Analyst or Detection Engineer level.
• Strong incident response, threat hunting, and forensic investigation experience.
• Strong written and verbal communication skills.
• Ability to work independently and collaborate with security, IT, and business teams.

Required Technical Skills

CrowdStrike Falcon & Detection Engineering

• Strong hands-on experience with CrowdStrike Falcon platform.
• Experience with Falcon Insight XDR, Discover, and/or Fusion SOAR.
• Experience creating custom detections and Indicators of Attack (IOA).
• Strong experience with Falcon Query Language (FQL).
• Experience developing detection analytics, dashboards, and hunting queries.
• Experience tuning alerts and improving detection accuracy.

SOC Operations & Incident Response

• Experience handling complex security incidents and Tier 3 escalations.
• Advanced threat hunting experience across endpoint, network, cloud, and identity telemetry.
• Root cause analysis and forensic investigation experience.
• Experience with security monitoring, alert tuning, and investigation workflows.
• Experience creating hunt reports, incident reports, runbooks, and SOP documentation.

SOAR & Security Automation

• Experience designing and maintaining SOAR playbooks.
• Strong experience with security automation workflows.
• Experience integrating security tools, ticketing systems, identity platforms, and communication platforms.
• Torq SOAR experience is highly preferred.

AI-Assisted Security Operations

• Practical experience using AI/LLM tools such as:
• Claude
• GPT-based tools
• Other enterprise-approved AI assistants

Experience using AI tools for:

• Alert triage acceleration.
• Security investigation support.
• Playbook generation.
• Detection engineering assistance.
• Analyst workflow automation.
• Security documentation.

Candidates must understand secure AI usage practices, including data sanitization and protection of sensitive information.

Key Responsibilities

• Serve as a Tier 3 SOC escalation point for complex security incidents.
• Perform advanced investigations, threat hunting, and root cause analysis.
• Design, develop, and maintain CrowdStrike Falcon detection logic and analytics.
• Create and optimize FQL queries, dashboards, and hunting workflows.
• Build and maintain SOAR automation playbooks using Torq and related security tools.
• Develop AI-assisted security workflows for analyst productivity.
• Lead incident response activities for high-severity cybersecurity events.
• Create security documentation, runbooks, SOPs, and investigation reports.
• Mentor Tier 1 and Tier 2 SOC analysts.
• Evaluate emerging security automation and AI capabilities.
• Participate in critical incident escalation support.

Additional Required Experience

• Strong scripting and automation skills using:
• Python
• PowerShell
• Falcon Query Language (FQL)
• Knowledge of Zero Trust Architecture principles (NIST 800-207).
• Familiarity with security compliance frameworks such as:
• IRS Pub. 1075
• FBI CJIS Policy
• HIPAA
• Experience with security tools such as:
• Microsoft Defender XDR
• Splunk
• Entra ID Protection
• Tenable One / CSPM platforms

Certifications (Highly Preferred)

• GCIH or equivalent
• GCIA or equivalent
• GCFA or equivalent
• CrowdStrike Certified Falcon Responder (CCFR)
• CrowdStrike Certified Falcon Administrator (CCFA)
• Torq Certification

Education

Bachelor’s degree in Computer Science, Information Security, Cybersecurity, or related field preferred. Equivalent professional experience will also be considered.

Requirements