Principal Detection Engineer (Remote, GBR) in Moffat

As a global leader in cybersecurity, CrowdStrike protects the people, processes and technologies that drive modern organizations. Since 2011, our mission hasn’t changed — we’re here to stop breaches, and we’ve redefined modern security with the world’s most advanced AI-native platform. We work on large scale distributed systems, processing almost 3 trillion events per day and this traffic is growing daily. Our customers span all industries, and they count on CrowdStrike to keep their businesses running, their communities safe and their lives moving forward.

CrowdStrikers drive their careers through flexibility and autonomy while also being expected to contribute to a culture of responsible AI adoption, experimentation, and innovation. We use an AI-first mindset as a force multiplier to proactively and continuously accelerate execution, build expertise, uncover insights, and solve complex problems. We’re always looking to add talented CrowdStrikers to the team who have limitless passion, a relentless focus on innovation and a fanatical commitment to our customers, our community and each other.

About the Role: CrowdStrike stops breaches. This role ensures we stop them everywhere, not just in one corner of the platform. Today, our detection teams operate across endpoint, cloud, NG-SIEM, identity, and SaaS security. They’re individually strong. But threat actors don’t respect domain boundaries, a supply chain attack lands on macOS, pivots through cloud credentials, and exfiltrates via a compromised SaaS app. We need someone who sees the full picture and turns it into detection coverage that outlasts any single campaign.

This function will report directly to the Sr Director of Engineering of the Detection Content Platform Group. This is a high visible, high impact role that will help us solve one of the hardest problems in cybersecurity: making an entire platform detect threats coherently, across every surface, at the speed adversaries operate. Threat actors are AI-force-multiplied, they stand up campaigns in hours and generate permutations on the fly. We need to detect and respond at the same scale and velocity.

What You’ll Do:

• Own cross-domain detection strategy. Maintain visibility into the detection team’s work, endpoint (Windows, macOS, Linux), cloud (AWS, GCP, Azure, Kubernetes), NG-SIEM, identity (IDP), SaaS security (Adaptive Shield), and FEM. Identify where the same attack scenario has coverage on one surface but gaps on another, and work with the teams to close those gaps systematically.
• Design high-fidelity correlation detections. Build detection logic that joins signals across domains, entity resolution, temporal reasoning, behavioral layering. Deliver high-severity, low-FP detections via Platform IOAs (CDE) that resist bypass and remain effective over time.
• Drive threat-informed prioritization. Monitor internal and external intel sources. Partner with OverWatch, Falcon Complete, product managers across all modules, and customer success teams. Translate threat landscape shifts into concrete detection investment decisions. Top threat scenarios get deep, multi-domain coverage before they hit customer environments.
• Coordinate cross-team detection development. When a researcher writes a detection for a scenario on one platform, ensure coverage ships across all relevant surfaces simultaneously. No detection ships in isolation when the scenario spans domains.
• Apply AI/LLM to detection workflows. Identify opportunities to use automation and large language models to accelerate gap analysis, triage threat intel, and prototype correlation logic. Drive adoption of AI-assisted workflows across the detection engineering function.
• Coach and enable detection engineers across teams. Set technical direction. PR reviews, hands-on technical coaching, co-development on hard problems. Raise the bar for what 'good detection' means across the organization.
• Influence product and platform direction. Identify gaps in telemetry, event coverage, or platform capabilities that limit detection quality. Work with sensor teams, product management, and platform engineering to close those gaps.

What You’ll Need:

• Strong detection engineering background. Have extensive experience writing production detection content across multiple platforms or data domains. Deep understanding of different telemetry sources, their limitations, and where coverage breaks down.
• Cross-domain thinking. Demonstrated ability to reason about threats that span multiple surfaces, endpoint to cloud, identity to SaaS, network to runtime. Have designed or contributed to detections that correlate signals across boundaries.
• Threat landscape fluency. Stay current on threat actors, campaigns, and TTPs. Able to translate threat intelligence into detection requirements and prioritization decisions.
• Detection content lifecycle experience. Understand what happens when detection libraries scale, aging rules, FP drift, performance cost, deprecation decisions. Have operated in an environment where detection quality is measured and maintained over time.
• Strong communication and influence. Able to work across multiple teams, drive alignment, and articulate detection strategy to both engineers and leadership. Able to drive outcomes through expertise and relationships.
• Technical leadership. Have guided or mentored engineers on detection quality, reviewed detection content at scale, or set technical standards for a detection engineering function.
• Proven experience utilizing AI technologies to enhance decision-making, streamline workflows and processes, improve efficiency and drive business outcomes.

Bonus Points:

• Experience applying AI/LLM to detection or security operations workflows
• EDR or SIEM vendor-side product experience
• MITRE ATT&CK fluency across multiple platforms
• Published security research (blogs, conference talks, tools, CVEs)
• Malware analysis or reverse engineering background
• Experience quantifying detection efficacy (precision, recall, bypass resistance)

Benefits of Working at CrowdStrike:

• Market leader in compensation and equity awards
• Comprehensive physical and mental wellness programs
• Competitive vacation and holidays for recharge
• Paid parental and adoption leaves
• Professional development opportunities for all employees regardless of level or role
• Employee Networks, geographic neighborhood groups, and volunteer opportunities to build connections
• Vibrant office culture with world class amenities
• Great Place to Work Certified across the globe

CrowdStrike is proud to be an equal opportunity employer. We are committed to fostering a culture of belonging where everyone is valued for who they are and empowered to succeed. We support veterans and individuals with disabilities through our affirmative action program.

CrowdStrike is committed to providing equal employment opportunity for all employees and applicants for employment. The Company does not discriminate in employment opportunities or practices on the basis of race, color, creed, ethnicity, religion, sex (including pregnancy or pregnancy-related medical conditions), sexual orientation, gender identity, marital or family status, veteran status, age, national origin, ancestry, physical disability (including HIV and AIDS), mental disability, medical condition, genetic information, membership or activity in a local human rights commission, status with regard to public assistance, or any other characteristic protected by law.

If you need assistance accessing or reviewing the information on this website or need help submitting an application for employment or requesting an accommodation, please contact us at recruiting@crowdstrike.com for further assistance.

Summary Location: United Kingdom - Remote Type: Full time