Detection & Response Engineer
At TechBiz Global · Cluj-Napoca, Cluj, Romania; Bucharest, București, Romania; Bucuresti, București, Romania; Belgrade, Beograd, Serbia; Chi…
- Engineering
- Full-time
See how well you match Match me reads your CV and picks the jobs that suit you best.
Get jobs like this within hours Radar emails you new jobs open to you within hours of us finding them, before most people see them.
Where you can work from
Open to Albania, Armenia, Bosnia and Herzegovina and 25 more
“Cluj-Napoca, Cluj, Romania”
From the location.
“Bucharest, București, Romania”
From the location.
“Bucuresti, București, Romania”
From the location.
“Belgrade, Beograd, Serbia”
From the location.
“Chișinău, Chișinău, Moldova, Republic of”
From the location.
“Tiraspol, Taraclia, Moldova, Republic of”
From the location.
Report a mistake
- Posted
- 11 November 2026
- First seen by us
- 12 November 2026
- Last checked
- 12 hours ago
Job description
From TechBiz Global’s job post, as they wrote it.
At TechBiz Global, we are providing recruitment service to our TOP clients from our portfolio. We are currently seeking a Detection & Response Engineer to join one of our clients' teams. If you're looking for an exciting opportunity to grow in a innovative environment, this could be the perfect fit for you.
Key Responsibilities:
* Investigate security cases and targeted hunts using CrowdStrike Falcon Next-Gen SIEM and CQL; correlate telemetry, assess scope and impact, document findings, and recommend appropriate actions.
Read the full description
* Develop, test, deploy, tune, and maintain detection logic, queries, dashboards, analyst guides, and version-controlled detection content.
* Build and maintain Falcon Fusion SOAR workflows for enrichment, evidence capture, routing, escalation, and authorized response.
* Validate telemetry coverage and quality; troubleshoot parsing, normalization, mapping, and source-data issues.
* Translate validated investigations into platform workflow specifications and co-build scripts, API integrations, workflow components, and prototypes with Product and Engineering.
* Test workflows and detections against representative cases; monitor outcomes, exceptions, and production feedback, and document ownership and support handoffs.
* Provide technical support, troubleshooting, knowledge transfer, and coaching; coordinate assigned analysis and platform work.
Must have:
* 5+ years of relevant security experience, including at least 2 years developing, testing, and tuning detection logic, or equivalent demonstrated capability.
* Production proficiency with CrowdStrike Falcon Next-Gen SIEM, including CQL, cross-source investigations, detection content, telemetry interpretation, and tuning.
* Hands-on Falcon Fusion SOAR workflow experience and practical use of Charlotte AI with evidence verification and awareness of approval boundaries.
* Practical Python, REST/Falcon APIs, JSON, authentication, error handling, and secure credential management; familiarity with PowerShell or another relevant scripting language.
* Experience with telemetry onboarding, parser/normalization troubleshooting, MITRE ATT&CK, Windows/Linux events, and controlled changes, version control, peer review, and regression testing.
* Strong investigation judgment, defensible documentation, communication, and cross-functional collaboration skills.
Nice to have:
* Experience converting SOC runbooks or manual analysis into production workflows or internal security platforms.
* CrowdStrike resident, responder, partner implementation, or customer-embedded Falcon experience; FalconPy or comparable API tooling.
* Experience partnering with Product and Engineering on analyst-facing features, case lifecycle integration, acceptance testing, or iterative delivery.
* Managed security services, multi-client or follow-the-sun SOC operations, and ITSM integrations such as ServiceNow or Jira.
* Relevant CrowdStrike training or credentials, GIAC invest
Detection & Response EngineerTechBiz Global
Apply on TechBiz Global (opens in a new tab)Get jobs like this by email
Once a week, we email the new remote jobs open where you live, each with the line that proves it. Every email has a one-click unsubscribe.
