> Markdown version of [/jobs/ext/2095987-principal-detection-engineer-remote-gbr](https://www.wearedevelopers.com/jobs/ext/2095987-principal-detection-engineer-remote-gbr). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Principal Detection Engineer (Remote, GBR)

- **Company:** CrowdStrike, Inc.
- **Location:** UK (Remote available)
- **Contract:** Permanent contract
- **Skills:** Microsoft Windows, Artificial Intelligence, Amazon Web Services, Apple Mac Systems, Microsoft Azure, Software as a Service, Cloud Computing, Cloud Computing Security, Cyber Security, Linux, Distributed Systems, Intrusion Detection and Prevention, Reverse Engineering, Security Information and Event Management, Google Cloud, Large Language Models, Mitre Att&ck, Malware, Kubernetes
- **Published:** August 17, 2026
- **Apply:** https://crowdstrike.wd5.myworkdayjobs.com/crowdstrikecareers/job/United-Kingdom---Remote/Principal-Detection-Engineer--Remote--GBR-_R29806

## About the Role

* Strong detection engineering background. Have extensive experience writing production detection content across multiple platforms or data domains. Deep understanding of different telemetry sources, their limitations, and where coverage breaks down.
 * Cross-domain thinking. Demonstrated ability to reason about threats that span multiple surfaces, endpoint to cloud, identity to SaaS, network to runtime. Have designed or contributed to detections that correlate signals across boundaries.
 * Threat landscape fluency. Stay current on threat actors, campaigns, and TTPs. Able to translate threat intelligence into detection requirements and prioritization decisions.
 * Detection content lifecycle experience. Understand what happens when detection libraries scale, aging rules, FP drift, performance cost, deprecation decisions. Have operated in an environment where detection quality is measured and maintained over time.
 * Strong communication and influence. Able to work across multiple teams, drive alignment, and articulate detection strategy to both engineers and leadership. Able to drive outcomes through expertise and relationships.
 * Technical leadership. Have guided or mentored engineers on detection quality, reviewed detection content at scale, or set technical standards for a detection engineering function.
 * Proven experience utilizing AI technologies to enhance decision-making, streamline workflows and processes, improve efficiency and drive business outcomes.

Bonus Points:

 * Experience applying AI/LLM to detection or security operations workflows
 * EDR or SIEM vendor-side product experience
 * MITRE ATT&CK fluency across multiple platforms
 * Published security research (blogs, conference talks, tools, CVEs)
 * Malware analysis or reverse engineering background
 * Experience quantifying detection efficacy (precision, recall, bypass resistance)

#LI-DR1

## Description

As a global leader in cybersecurity, CrowdStrike protects the people, processes and technologies that drive modern organizations. Since 2011, our mission hasn't changed - we're here to stop breaches, and we've redefined modern security with the world's most advanced AI-native platform. We work on large scale distributed systems, processing almost 3 trillion events per day and this traffic is growing daily. Our customers span all industries, and they count on CrowdStrike to keep their businesses running, their communities safe and their lives moving forward. We're proud to work for a mission-driven company leveraging AI to transform the way we work. CrowdStrikers drive their careers through flexibility and autonomy while also being expected to contribute to a culture of responsible AI adoption, experimentation, and innovation. We use an AI-first mindset as a force multiplier to proactively and continuously accelerate execution, build expertise, uncover insights, and solve complex
problems. We're always looking to add talented CrowdStrikers to the team who have limitless passion, a relentless focus on innovation and a fanatical commitment to our customers, our community and each other. Ready to join a mission that matters? The future of cybersecurity starts with you.

About the Role:

CrowdStrike stops breaches. This role ensures we stop them everywhere, not just in one corner of the platform.

Today, our detection teams operate across endpoint, cloud, NG-SIEM, identity, and SaaS security. They're individually strong. But threat actors don't respect domain boundaries, a supply chain attack lands on macOS, pivots through cloud credentials, and exfiltrates via a compromised SaaS app. We need someone who sees the full picture and turns it into detection coverage that outlasts any single campaign.

This function will report directly to the Sr Director of Engineering of the Detection Content Platform Group. This is a high visible, high impact role that will help us solve one of the hardest problems in cybersecurity: making an entire platform detect threats coherently, across every surface, at the speed adversaries operate. Threat actors are AI-force-multiplied, they stand up campaigns in hours and generate permutations on the fly. We need to detect and respond at the same scale and velocity..

What You'll Do:

 * Own cross-domain detection strategy. Maintain visibility into the detection team's work, endpoint (Windows, macOS, Linux), cloud (AWS, GCP, Azure, Kubernetes), NG-SIEM, identity (IDP), SaaS security (Adaptive Shield), and FEM. Identify where the same attack scenario has coverage on one surface but gaps on another, and work with the teams to close those gaps systematically.
 * Design high-fidelity correlation detections. Build detection logic that joins signals across domains, entity resolution, temporal reasoning, behavioral layering. Deliver high-severity, low-FP detections via Platform IOAs (CDE) that resist bypass and remain effective over time.
 * Drive threat-informed prioritization. Monitor internal and external intel sources. Partner with OverWatch, Falcon Complete, product managers across all modules, and customer success teams. Translate threat landscape shifts into concrete detection investment decisions. Top threat scenarios get deep, multi-domain coverage before they hit customer environments.
 * Coordinate cross-team detection development. When a researcher writes a detection for a scenario on one platform, ensure coverage ships across all relevant surfaces simultaneously. No detection ships in isolation when the scenario spans domains.
 * Apply AI/LLM to detection workflows. Identify opportunities to use automation and large language models to accelerate gap analysis, triage threat intel, and prototype correlation logic. Drive adoption of AI-assisted workflows across the detection engineering function.
 * Coach and enable detection engineers across teams. Set technical direction. PR reviews, hands-on technical coaching, co-development on hard problems. Raise the bar for what "good detection" means across the organization.
 * Influence product and platform direction. Identify gaps in telemetry, event coverage, or platform capabilities that limit detection quality. Work with sensor teams, product management, and platform engineering to close those gaps.


## Related Videos

- [Docker network without Docker](https://www.wearedevelopers.com/videos/1418-docker-network-without-docker)
- [Enhancing Workload Security in Kubernetes](https://www.wearedevelopers.com/videos/356-enhancing-workload-security-in-kubernetes)
- [Understanding Kubernetes in a visual way](https://www.wearedevelopers.com/videos/100085-understanding-kubernetes-in-a-visual-way)
- [Checkmate: 5 Real Incidents That Can End a Software Company](https://www.wearedevelopers.com/videos/100126-checkmate-5-real-incidents-that-can-end-a-software-company)
- [The Developer Workstation Blind Spot: Why Your Security Stack Can't See What Matters Most](https://www.wearedevelopers.com/videos/100254-the-developer-workstation-blind-spot-why-your-security-stack-can-t-see-what-matters-most)
- [Docker exec without Docker](https://www.wearedevelopers.com/videos/1094-docker-exec-without-docker)

## Related Articles

- [Fully Remote Software Engineer Jobs](https://www.wearedevelopers.com/magazine/447-fully-remote-software-engineer-jobs)
- [Dev Digest 191: Malware interviews, EU ❤️ Open Source and Skilled Agents](https://www.wearedevelopers.com/magazine/645-dev-digest-191-malware-interviews-eu-open-source-and-skilled-agents)
- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)
- [Dev Digest 121 - AI goes offline](https://www.wearedevelopers.com/magazine/456-dev-digest-121-ai-goes-offline)
- [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this)
- [Find a Developer Job: 12 Best Job Sites For Developers](https://www.wearedevelopers.com/magazine/165-find-a-developer-job-12-best-job-sites-for-developers)