Principal Detection Engineer (Remote, GBR)

As a global leader in cybersecurity, CrowdStrike protects the people, processes and technologies that drive modern organizations. Since 2011, our mission hasn’t changed — we’re here to stop breaches, and we’ve redefined modern security with the world’s most advanced AI-native platform. We work on large scale distributed systems, processing almost 3 trillion events per day and this traffic is growing daily. Our customers span all industries, and they count on CrowdStrike to keep their businesses running, their communities safe and their lives moving forward.

About the Role

CrowdStrike stops breaches. This role ensures we stop them everywhere, not just in one corner of the platform. Today, our detection teams operate across endpoint, cloud, NG-SIEM, identity, and SaaS security. They’re individually strong. But threat actors don't respect domain boundaries, a supply chain attack lands on macOS, pivots through cloud credentials, and exfiltrates via a compromised SaaS app. We need someone who sees the full picture and turns it into detection coverage that outlasts any single campaign. This function will report directly to the Sr Director of Engineering of the Detection Content Platform Group. This is a high visible, high impact role that will help us solve one of the hardest problems in cybersecurity: making an entire platform detect threats coherently, across every surface, at the speed adversaries operate.

What You’ll Do

• Own cross-domain detection strategy.
• Maintain visibility into the detection team’s work, endpoint (Windows, macOS, Linux), cloud (AWS, GCP, Azure, Kubernetes), NG-SIEM, identity (IDP), SaaS security (Adaptive Shield), and FEM.
• Identify where the same attack scenario has coverage on one surface but gaps on another, and work with the teams to close those gaps systematically.
• Design high-fidelity correlation detections.
• Build detection logic that joins signals across domains, entity resolution, temporal reasoning, behavioral layering.
• Deliver high-severity, low-FP detections via Platform IOAs (CDE) that resist bypass and remain effective over time.
• Drive threat-informed prioritization.
• Monitor internal and external intel sources.
• Partner with OverWatch, Falcon Complete, product managers across all modules, and customer success teams.
• Translate threat landscape shifts into concrete detection investment decisions.
• Coordinate cross-team detection development.
• Apply AI/LLM to detection workflows.
• Drive adoption of AI-assisted workflows across the detection engineering function.
• Coach and enable detection engineers across teams.
• Set technical direction.
• Raise the bar for what 'good detection' means across the organization.
• Influence product and platform direction.

What You’ll Need

• Strong detection engineering background.
• Have extensive experience writing production detection content across multiple platforms or data domains.
• Deep understanding of different telemetry sources, their limitations, and where coverage breaks down.
• Cross-domain thinking.
• Threat landscape fluency.
• Detection content lifecycle experience.
• Strong communication and influence.
• Technical leadership.

Bonus Points

• Experience applying AI/LLM to detection or security operations workflows.
• EDR or SIEM vendor-side product experience.
• MITRE ATT&CK fluency across multiple platforms.
• Published security research (blogs, conference talks, tools, CVEs).
• Malware analysis or reverse engineering background.
• Experience quantifying detection efficacy (precision, recall, bypass resistance).

Benefits of Working at CrowdStrike

• Market leader in compensation and equity awards.
• Comprehensive physical and mental wellness programs.
• Competitive vacation and holidays for recharge.
• Paid parental and adoption leaves.
• Professional development opportunities for all employees regardless of level or role.
• Employee Networks, geographic neighborhood groups, and volunteer opportunities to build connections.
• Vibrant office culture with world class amenities.
• Great Place to Work Certified across the globe.

CrowdStrike is proud to be an equal opportunity employer. We are committed to fostering a culture of belonging where everyone is valued for who they are and empowered to succeed.