> Markdown version of [/jobs/ext/1992770-detection-engineering-soar-architect](https://www.wearedevelopers.com/jobs/ext/1992770-detection-engineering-soar-architect). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Detection Engineering & SOAR Architect

- **Company:** Resourcesoft, Inc.
- **Location:** Austin, TX, United States
- **Experience:** Expert
- **Contract:** Permanent contract
- **Skills:** Application Programming Interfaces (APIs), Artificial Intelligence, Code Review, Query Languages, Identity and Access Management, Python (Programming Language), Windows PowerShell, Zero Trust Network Access, Runbook, Large Language Models, Generative AI, Cybercrime, 3-tier Architectures, GPT, Security Orchestration, Automation & Response
- **Published:** August 8, 2026
- **Apply:** https://www.dice.com/job-detail/20b69cb5-6f00-4e59-8a86-173be7cf3577

## About the Role

* 8 or more years of experience in security operations center (SOC) environments and Tier 3 incident response.
 * Proficiency in CrowdStrike Falcon XDR, custom IOA authoring, and Falcon Query Language (FQL).
 * Experience with Torq Security Orchestration, Automation, and Response (SOAR) playbook engineering.
 * Experience in integrating Generative AI, Large Language Models (Claude/GPT), and automated triage workflows.
 * Experience with Zero Trust architecture principles, NIST 800-207, and regulatory compliance standards like CJIS or HIPAA.
 * Experience in Python, PowerShell, or API scripting for custom detection logic and security automation.
 * Excellent verbal and written communication skills.

## Description

* Perform deep-dive Tier 3 incident investigations, threat hunting, and forensic root-cause analysis across enterprise telemetry.
 * Author, tune, and optimize custom detection analytics, dashboards, and correlation rules inside CrowdStrike Falcon.
 * Architect automated SOAR playbooks in Torq, connecting CrowdStrike, identity platforms, and ticketing systems.
 * Design AI-assisted analyst workflows and LLM alert summaries while enforcing strict data sanitization guardrails.
 * Lead incident response containment efforts for high-severity security events in regulated environments.
 * Create detection engineering runbooks, standard operating procedures, and technical documentation for Tier 1 and Tier 2 staff.
 * Mentor junior SOC analysts, conduct investigative code reviews, and evaluate emerging security automation tools.


## Related Videos

- [Fighting the Next Wave of Cybercrime](https://www.wearedevelopers.com/videos/100331-fighting-the-next-wave-of-cybercrime)
- [Cyber Sleuth: Finding Hidden Connections in Cyber Data](https://www.wearedevelopers.com/videos/893-cyber-sleuth-finding-hidden-connections-in-cyber-data)
- [Technical Documentation - How Can I Write Them Better and Why Should I Care?](https://www.wearedevelopers.com/videos/681-technical-documentation-how-can-i-write-them-better-and-why-should-i-care)
- [ Evaluating AI models for code comprehension](https://www.wearedevelopers.com/videos/1462-evaluating-ai-models-for-code-comprehension)
- [Deep Fakes: The Lies We Can’t See](https://www.wearedevelopers.com/videos/1187-deep-fakes-the-lies-we-can-t-see)
- [Bridging AI and Nomad: a Go-based MCP Server for Cluster Control](https://www.wearedevelopers.com/videos/2063-bridging-ai-and-nomad-a-go-based-mcp-server-for-cluster-control)

## Related Articles

- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)
- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)
- [The Best X (Twitter) Accounts for Developers](https://www.wearedevelopers.com/magazine/294-the-best-x-twitter-accounts-for-developers)
- [Dev Digest 120 - Apple and peers](https://www.wearedevelopers.com/magazine/455-dev-digest-120-apple-and-peers)
- [Dev Digest 137 - AI'm not sure about this](https://www.wearedevelopers.com/magazine/485-dev-digest-137-ai-m-not-sure-about-this)
- [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this)