Senior Detection and Incident Response Engineer

InvestCloud, Inc. • ,

17h • $175,000 - $185,000

About The Position

InvestCloud is seeking a Senior Detection and Incident Response Engineer to own and improve detection and response capabilities across its environment. The role owns the CrowdStrike Falcon platform, designs broad logging and monitoring coverage, and develops automation to detect, contain, and remediate threats quickly while protecting business operations. The engineer leads technical incident response from initial alert through closure and keeps leadership informed.

The position manages the managed detection and response provider, improves its detections, and holds it accountable to measurable service levels. It also leads and develops detection and response engineers in the U.S. and India and participates in the on-call rotation. The security team spans the United States, Romania, and India and protects platforms used by banks and wealth managers.

Requirements

• Eight or more years of experience in detection engineering and incident response, including leading responses to real incidents.
• Expert-level CrowdStrike Falcon administration, including Falcon Fusion SOAR workflows, Real Time Response, host grouping and tagging, and Falcon APIs.
• Expert experience with managed detection and response (MDR), extended detection and response (XDR), and managed security service providers (MSSPs).
• Deep knowledge of Windows and Linux system logs, firewall logs, identity logs, and cloud audit logs, and how to use them to find attackers.
• Strong scripting skills in Python, PowerShell, or similar, and experience automating through APIs.
• Experience with a SIEM platform such as CrowdStrike Falcon Next-Gen SIEM, Splunk, or Microsoft Sentinel.
• Working knowledge of MITRE ATT&CK and mapping detection coverage to it.
• Calm, clear communication during high-pressure incidents.

Nice To Haves

• Digital forensics experience or certifications such as GCIH, GCFA, or GNFA.
• Experience in financial services or another regulated industry.
• Experience with anti-ransomware or deception technologies.

Responsibilities

• Own and administer the CrowdStrike Falcon platform, including policy, tuning, host tagging and grouping, Real Time Response, and Falcon Fusion workflows.
• Design detection coverage across endpoints, identity, cloud, network, firewall, email, and SaaS applications, and identify and close coverage gaps.
• Build automation to detect, contain, and remediate threats rapidly, with safeguards against unintended business disruption.
• Lead technical incident response from first alert to closure, including containment, investigation, evidence handling, and lessons learned.
• Manage the managed detection and response provider, tune its detections, and hold it to measurable service levels.
• Analyze system, firewall, identity, and application logs to identify and confirm malicious activity.
• Write and test incident response playbooks and run exercises with technical and business teams.
• Lead and develop detection and response engineers in the U.S. and India.
• Participate in the on-call rotation.
• Provide clear updates to leadership during serious incidents.

Benefits

• Medical/Rx insurance
• Dental insurance
• Vision insurance
• Disability insurance
• Life and AD&D insurance
• Flexible Savings Account (FSA)
• Health Savings Account (HSA)
• Employee Assistance Plan (EAP)
• Health advocacy
• Voluntary ancillary plans, including accident, critical illness, hospital indemnity, legal, identity theft, auto/home, and pet insurance
• 401(k) retirement savings plan with company match
• Paid time off

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed