Principal Detection Engineer (Remote, GBR)

As a global leader in cybersecurity, CrowdStrike protects the people, processes and technologies that drive modern organizations. Since 2011, our mission hasn’t changed — we’re here to stop breaches, and we’ve redefined modern security with the world’s most advanced AI-native platform. We work on large scale distributed systems, processing almost 3 trillion events per day and this traffic is growing daily. Our customers span all industries, and they count on CrowdStrike to keep their businesses running, their communities safe and their lives moving forward.

CrowdStrike stops breaches. This role ensures we stop them everywhere, not just in one corner of the platform. Today, our detection teams operate across endpoint, cloud, NG-SIEM, identity, and SaaS security. They're individually strong. But threat actors don't respect domain boundaries, a supply chain attack lands on macOS, pivots through cloud credentials, and exfiltrates via a compromised SaaS app. We need someone who sees the full picture and turns it into detection coverage that outlasts any single campaign.

This function will report directly to the Sr Director of Engineering of the Detection Content Platform Group. This is a high visible, high impact role that will help us solve one of the hardest problems in cybersecurity: making an entire platform detect threats coherently, across every surface, at the speed adversaries operate. Threat actors are AI-force-multiplied, they stand up campaigns in hours and generate permutations on the fly. We need to detect and respond at the same scale and velocity.

What You’ll Do:

• Own cross-domain detection strategy. Maintain visibility into the detection team's work, endpoint (Windows, macOS, Linux), cloud (AWS, GCP, Azure, Kubernetes), NG-SIEM, identity (IDP), SaaS security (Adaptive Shield), and FEM. Identify where the same attack scenario has coverage on one surface but gaps on another, and work with the teams to close those gaps systematically.
• Design high-fidelity correlation detections. Build detection logic that joins signals across domains, entity resolution, temporal reasoning, behavioral layering. Deliver high-severity, low-FP detections via Platform IOAs (CDE) that resist bypass and remain effective over time.
• Drive threat-informed prioritization. Monitor internal and external intel sources. Partner with OverWatch, Falcon Complete, product managers across all modules, and customer success teams. Translate threat landscape shifts into concrete detection investment decisions.
• Coordinate cross-team detection development. When a researcher writes a detection for a scenario on one platform, ensure coverage ships across all relevant surfaces simultaneously.
• Apply AI/LLM to detection workflows. Identify opportunities to use automation and large language models to accelerate gap analysis, triage threat intel, and prototype correlation logic.
• Coach and enable detection engineers across teams. Set technical direction. PR reviews, hands-on technical coaching, co-development on hard problems.
• Influence product and platform direction. Identify gaps in telemetry, event coverage, or platform capabilities that limit detection quality.

What You’ll Need:

• Strong detection engineering background. Have extensive experience writing production detection content across multiple platforms or data domains.
• Cross-domain thinking. Demonstrated ability to reason about threats that span multiple surfaces, endpoint to cloud, identity to SaaS, network to runtime.
• Threat landscape fluency. Stay current on threat actors, campaigns, and TTPs. Able to translate threat intelligence into detection requirements and prioritization decisions.
• Detection content lifecycle experience. Understand what happens when detection libraries scale, aging rules, FP drift, performance cost, deprecation decisions.
• Strong communication and influence. Able to work across multiple teams, drive alignment, and articulate detection strategy to both engineers and leadership.
• Technical leadership. Have guided or mentored engineers on detection quality, reviewed detection content at scale, or set technical standards for a detection engineering function.
• Proven experience utilizing AI technologies to enhance decision-making, streamline workflows and processes, improve efficiency and drive business outcomes.

Bonus Points:

• Experience applying AI/LLM to detection or security operations workflows.
• EDR or SIEM vendor-side product experience.
• MITRE ATT&CK fluency across multiple platforms.
• Published security research (blogs, conference talks, tools, CVEs).
• Malware analysis or reverse engineering background.
• Experience quantifying detection efficacy (precision, recall, bypass resistance).

Benefits of Working at CrowdStrike:

• Market leader in compensation and equity awards.
• Comprehensive physical and mental wellness programs.
• Competitive vacation and holidays for recharge.
• Paid parental and adoption leaves.
• Professional development opportunities for all employees regardless of level or role.
• Employee Networks, geographic neighborhood groups, and volunteer opportunities to build connections.
• Vibrant office culture with world class amenities.
• Great Place to Work Certified across the globe.

CrowdStrike is proud to be an equal opportunity employer. We are committed to fostering a culture of belonging where everyone is valued for who they are and empowered to succeed.