Detection Engineering & SOAR Architect

Resourcesoft, Inc.
Austin, TX, United States
4 days ago

Role details

Contract type
Permanent contract
Employment type
Full-time (> 32 hours)
Experience level
Expert
Experience required
8 years minimum
Working hours
Regular working hours
Job source

Tech stack

Application Programming Interfaces (APIs) Artificial Intelligence Code Review Query Languages Identity and Access Management Python (Programming Language) Windows PowerShell Zero Trust Network Access Runbook Large Language Models Generative AI Cybercrime
+3 more
3-tier Architectures GPT Security Orchestration, Automation & Response

Job description

  • Perform deep-dive Tier 3 incident investigations, threat hunting, and forensic root-cause analysis across enterprise telemetry.
  • Author, tune, and optimize custom detection analytics, dashboards, and correlation rules inside CrowdStrike Falcon.
  • Architect automated SOAR playbooks in Torq, connecting CrowdStrike, identity platforms, and ticketing systems.
  • Design AI-assisted analyst workflows and LLM alert summaries while enforcing strict data sanitization guardrails.
  • Lead incident response containment efforts for high-severity security events in regulated environments.
  • Create detection engineering runbooks, standard operating procedures, and technical documentation for Tier 1 and Tier 2 staff.
  • Mentor junior SOC analysts, conduct investigative code reviews, and evaluate emerging security automation tools.

Requirements

  • 8 or more years of experience in security operations center (SOC) environments and Tier 3 incident response.
  • Proficiency in CrowdStrike Falcon XDR, custom IOA authoring, and Falcon Query Language (FQL).
  • Experience with Torq Security Orchestration, Automation, and Response (SOAR) playbook engineering.
  • Experience in integrating Generative AI, Large Language Models (Claude/GPT), and automated triage workflows.
  • Experience with Zero Trust architecture principles, NIST 800-207, and regulatory compliance standards like CJIS or HIPAA.
  • Experience in Python, PowerShell, or API scripting for custom detection logic and security automation.
  • Excellent verbal and written communication skills.

About the company

Founded in 1999, Resourcesoft, Inc. is a leading Technology Consulting and Professional Services organization. Headquartered in Marlborough, MA, the company serves the technology needs of its clients nationwide. Resourcesoft has often been recognized by prominent rating agencies for its exemplary growth and stability. With over two decades of industry experience, the Company has evolved as a front runner in enabling project optimization. We partner with leading organizations to provide technology solutions within the financial, insurance, education, government, publishing, healthcare and pharmaceutical domains. We take pride in mentoring a workforce that is well positioned to respond to the emerging IT trends and needs. With the employees at the crux of every business endeavor, our success is driven by our expertise in pairing the right talent with the best jobs in the technology sector. We forge long term, personalized relationships with our employees to advance their career to the next level. We engage them in technology centric client projects that provide opportunities for them to evolve, innovate and deliver world class products and services. Our career opportunities offer challenging assignments and exposure to emerging and cutting edge technologies. We are committed to providing our employees with the tools necessary to accelerate their career progression, while maintaining a healthy, work-life balance. We are deeply committed to providing a workplace ambience that is both challenging and fulfilling.

Apply for this position

This job is hosted externally. Click below to view the full posting and apply.

Apply on www.dice.com

Good distractions

Talks and stories from around this role — technically off-topic, practically not.

3:22 min

Transitioning from software engineering to security roles

Anna Oliveira · Coffee With Developers

4:34 min

Motivational categories behind modern cybercriminal activities

Mauro Verderosa · LIVE

2:50 min

Introduction and the value of runbooks

Hila Fish · WWC 2023

40 sec

Generative pre-trained transformer models powering code completions

lgonta lgonta +1 · WWC 2024

2:11 min

Securing heterogeneous legacy payment infrastructure against AI

Michele Zuccala Michele Zuccala +4 · WWC Europe 2026

1:32 min

Structuring automated incident workflows between runbooks and raw models

Aram Hakobyan Aram Hakobyan +1 · WWC Europe 2026

Videos

See all

Related articles

See all