> Markdown version of [/jobs/ext/4285787-detection-and-incident-response-engineer](https://www.wearedevelopers.com/jobs/ext/4285787-detection-and-incident-response-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Detection and Incident Response Engineer - **Company:** InvestCloud, Inc. - **Location:** United States (Remote available) - **Experience:** Expert - **Salary:** $175,000.0 - $180,000.0 - **Contract:** Permanent contract - **Skills:** Microsoft Windows, Application Programming Interfaces (APIs), Apple Mac Systems, Computer Vision, Audit Trail, Cloud Computing, Cyber Security, Linux, Digital Forensics, Intrusion Detection and Prevention, Python (Programming Language), Network Forensics, Windows PowerShell, CrowdStrike Falcon Management, Security Information and Event Management, Scripting, Mitre Att&ck, Information Technology, Cybercrime, Microsoft Sentinel, Splunk - **Published:** October 19, 2026 - **Apply:** https://www.builtincolorado.com/job/senior-detection-and-incident-response-engineer/11772910?handler=ApplyRedirect ## About the Role * Eight or more years of experience in detection engineering and incident response, including leading the response to real incidents. * Expert-level CrowdStrike Falcon administration, including Falcon Fusion security orchestration, automation, and response (SOAR) workflows, Real Time Response, host grouping and tagging, and the Falcon APIs. * Expert experience with managed detection and response (MDR), extended detection and response (XDR), and managed security service providers (MSSPs). * Deep knowledge of Windows and Linux system logs, firewall logs, identity logs, and cloud audit logs, and how to use them to find an attacker. * Strong scripting skills in Python, PowerShell, or similar, and experience automating through APIs. * Experience with a security information and event management (SIEM) platform such as CrowdStrike Falcon Next-Gen SIEM, Splunk, or Microsoft Sentinel. * Working knowledge of MITRE ATT&CK and how to map detection coverage to it. * Calm, clear communication during high-pressure incidents. Preferred qualifications * Digital forensics experience or certifications such as GCIH, GCFA, or GNFA. * Experience in financial services or another regulated industry. * Experience with anti-ransomware or deception technologies. Who you are * You hold yourself to a world-class standard, and it shows in everything you deliver. * You are a self-starter. You find the work that matters and finish it without being asked. * You care about this field beyond the job description. You keep learning and building on your own because you enjoy it, and you put in the extra effort when the mission calls for it. * You bring drive, ambition, and a positive attitude to hard problems. * You make the people around you better. You share what you know, you never make anyone feel small, and you let your work speak for itself. ## Description We are looking for a Senior Detection and Incident Response Engineer who can see an attack anywhere and stop it fast. You will own CrowdStrike, design the logging and monitoring that gives us complete visibility, and build automation that detects, contains, and remediates threats at machine speed without disrupting the business. When a real incident happens, you will lead the response with precision and keep leadership informed. How you will provide meaningful contributions * Own the CrowdStrike Falcon platform end to end, including policy, tuning, host tagging and grouping, Real Time Response, and Falcon Fusion workflows. * Design detection coverage across endpoints, identity, cloud, network, firewall, email, and SaaS applications, and close the gaps that remain. * Build automation that detects, contains, and remediates threats in seconds, with safeguards that prevent unintended business disruption. * Lead technical incident response from first alert to closure, including containment, investigation, evidence, and lessons learned. * Manage our managed detection and response (MDR) provider, tune its detections, and hold it to measurable service levels. * Analyze system, firewall, identity, and application logs to find and confirm malicious activity. * Write and test incident response playbooks, and run exercises with technical and business teams. * Lead and develop detection and response engineers in the U.S. and India, and take part in the on-call rotation. What success looks like in your first year * We can see an attack in any part of our environment, and we know exactly where any remaining blind spots are and how we will close them. * Common threats are detected and contained automatically, in seconds, without breaking anything the business depends on. * Serious incidents are contained quickly and precisely, with clear updates to leadership. * CrowdStrike and our managed detection partner are tuned and held to measurable results., Lead biopharma business development across the US West Coast and Central States, acquiring pharmaceutical and biotechnology customers and expanding strategic accounts. Build and manage Salesforce pipeline, develop proposals, negotiate agreements, and close projects involving genomic assays, biomarker discovery, clinical trial assays, precision medicine, and companion diagnostics. Collaborate with scientific, commercial, and operational teams to shape customer solutions. Travel domestically and internationally approximately 30% of the time.