Detection & Response Engineer

Location: Cluj-Napoca, Romania; Bucharest, Romania; Bucuresti, Romania; Belgrade, Serbia; Chișinău, Moldova, Republic of; Tiraspol, Moldova, Republic of; Sofia, Bulgaria; Erevan, Armenia; Almaty, Kazakhstan; Astana, Kazakhstan; Budapest, Hungary; Miskolc, Hungary; Bryanston, South Africa; Cape Town, South Africa; Johannesburg, South Africa; Aya Napa, Cyprus; Larnaca, Cyprus; Limassol, Cyprus; Nicosia, Cyprus; Paphos, Cyprus; Paralimni, Cyprus; Amman, Jordan; Alexandria, Egypt; Cairo, Egypt; Lebanon; Dnipro, Ukraine; Kharkiv, Ukraine; Kyiv, Ukraine; Lviv, Ukraine; Sambir, Ukraine; Odesa, Ukraine Workplace: remote At TechBiz Global, we are providing recruitment service to our TOP clients from our portfolio. We are currently seeking a Detection & Response Engineer to join one of our clients' teams. If you're looking for an exciting opportunity to grow in a innovative environment, this could be the perfect fit for you. Key Responsibilities: Investigate security cases and targeted hunts using CrowdStrike Falcon Next-Gen SIEM and CQL; correlate telemetry, assess scope and impact, document findings, and recommend appropriate actions. Develop, test, deploy, tune, and maintain detection logic, queries, dashboards, analyst guides, and version-controlled detection content. Build and maintain Falcon Fusion SOAR workflows for enrichment, evidence capture, routing, escalation, and authorized response. Validate telemetry coverage and quality; troubleshoot parsing, normalization, mapping, and source-data issues. Translate validated investigations into platform workflow specifications and co-build scripts, API integrations, workflow components, and prototypes with Product and Engineering. Test workflows and detections against representative cases; monitor outcomes, exceptions, and production feedback, and document ownership and support handoffs. Provide technical support, troubleshooting, knowledge transfer, and coaching; coordinate assigned analysis and platform work. Must have: 5+ years of relevant security experience, including at least 2 years developing, testing, and tuning detection logic, or equivalent demonstrated capability. Production proficiency with CrowdStrike Falcon Next-Gen SIEM, including CQL, cross-source investigations, detection content, telemetry interpretation, and tuning. Hands-on Falcon Fusion SOAR workflow experience and practical use of Charlotte AI with evidence verification and awareness of approval boundaries. Practical Python, REST/Falcon APIs, JSON, authentication, error handling, and secure credential management; familiarity with PowerShell or another relevant scripting language. Experience with telemetry onboarding, parser/normalization troubleshooting, MITRE ATT&CK, Windows/Linux events, and controlled changes, version control, peer review, and regression testing. Strong investigation judgment, defensible documentation, communication, and cross-functional collaboration skills. Nice to have: Experience converting SOC runbooks or manual analysis into production workflows or internal security platforms. CrowdStrike resident, responder, partner implementation, or customer-embedded Falcon experience; FalconPy or comparable API tooling. Experience partnering with Product and Engineering on analyst-facing features, case lifecycle integration, acceptance testing, or iterative delivery. Managed security services, multi-client or follow-the-sun SOC operations, and ITSM integrations such as ServiceNow or Jira. Relevant CrowdStrike training or credentials, GIAC invest