Detection & Response Engineer

Security Engineer / Risk Operations (SIEM Investigations & Detection Engineering)

Location: Philippines
Engagement type: Contractor / Full-time
Level: Individual contributor, 5+ years in security

About Rad Hires

Rad Hires is a recruiting partner that connects high-growth companies with exceptional talent. We work closely with our clients to understand what they actually need — not just what's written in a job posting — and we work closely with candidates to find roles that genuinely fit.

About the company

Our client is a cybersecurity company built to help organizations reduce exploitable risk-fast, measurably, and defensibly. They combine a disciplined operating model for risk reduction with a platform-led approach that turns exposures and detections into prioritized remediation plans, validated outcomes, and executive-ready reporting.

About the role

This is a hands-on role that sits between investigation and engineering. You’ll work real security cases in CrowdStrike Falcon Next-Gen SIEM. Then you’ll turn the methods that hold up into tested, reusable detections and workflows that the rest of the organization can rely on.

You’ll sit in Risk Operations and work closely with SOC, Product, Engineering, CTI, GRC and customer-delivery teams. Part of your week is investigations and hunts. Part is detection engineering and SOAR automation. Part is co-building internal platform capabilities with Product and Engineering.

What you’ll do

• Investigate security cases and run targeted hunts in Falcon Next-Gen SIEM using CQL. You’ll correlate telemetry, assess scope and impact, document findings and recommend actions.
• Develop, test, deploy, tune and maintain detection logic, queries, dashboards, analyst guides and version-controlled detection content.
• Build and maintain Falcon Fusion SOAR workflows for enrichment, evidence capture, routing, escalation and authorized response.
• Validate telemetry coverage and quality, and troubleshoot parsing, normalization, mapping and source-data issues.
• Translate validated investigations into platform workflow specs. With Product and Engineering, co-build scripts, API integrations, workflow components and prototypes.
• Test workflows and detections against representative cases, monitor outcomes, exceptions and production feedback, and document ownership and support handoffs.
• Provide technical support, troubleshooting, knowledge transfer and coaching, and coordinate assigned analysis and platform work.

What we look for

• 5+ years of relevant security experience, including at least 2 years developing, testing and tuning detection logic (or equivalent demonstrated capability).
• Production proficiency with CrowdStrike Falcon Next-Gen SIEM: CQL, cross-source investigations, detection content, telemetry interpretation and tuning.
• Hands-on Falcon Fusion SOAR workflow experience.
• Practical use of Charlotte AI, with evidence verification and awareness of approval boundaries.
• Practical Python, REST/Falcon APIs, JSON, authentication, error handling and secure credential management.
• Familiarity with PowerShell or another relevant scripting language.
• Experience with telemetry onboarding, parser/normalization troubleshooting, MITRE ATT&CK, and Windows/Linux events.
• Disciplined change practice: controlled changes, version control, peer review and regression testing.
• Strong investigation judgment and defensible documentation.
• Clear communication and cross-functional collaboration.

Signals we love

• You’ve converted SOC runbooks or manual analysis into production workflows or internal security platforms.
• You have CrowdStrike resident, responder, partner-implementation or customer-embedded Falcon experience.
• You’ve used FalconPy or comparable API tooling.
• You’ve partnered with Product and Engineering on analyst-facing features, case lifecycle integration, acceptance testing or iterative delivery.
• You have a background in managed security services or multi-client / follow-the-sun SOC operations.
• You’ve worked with ITSM integrations such as ServiceNow or Jira.
• You hold CrowdStrike training or credentials, or GIAC investigation/detection certifications.

This role is not for you if

• You want to do only alert triage, or only engineering. This role needs both.
• You prefer shipping detections without testing, peer review or documented handoffs.
• You haven’t worked in Falcon Next-Gen SIEM and Fusion SOAR in production.

Logistics

• Location / remote: Philippines
• Engagement type: Contractor
• Reports to: Security department