Principal Detection Engineer (Remote, GBR)

As a global leader in cybersecurity, CrowdStrike protects the people, processes and technologies that drive modern organizations. Since 2011, our mission hasn’t changed — we’re here to stop breaches, and we’ve redefined modern security with the world’s most advanced AI-native platform. We work on large scale distributed systems, processing almost 3 trillion events per day and this traffic is growing daily. Our customers span all industries, and they count on CrowdStrike to keep their businesses running, their communities safe and their lives moving forward. We're proud to work for a mission-driven company leveraging AI to transform the way we work. CrowdStrikers drive their careers through flexibility and autonomy while also being expected to contribute to a culture of responsible AI adoption, experimentation, and innovation. We use an AI-first mindset as a force multiplier to proactively and continuously accelerate execution, build expertise, uncover insights, and solve complex problems. We’re always looking to add talented CrowdStrikers to the team who have limitless passion, a relentless focus on innovation and a fanatical commitment to our customers, our community and each other. Ready to join a mission that matters? The future of cybersecurity starts with you.

About the Role:

CrowdStrike stops breaches. This role ensures we stop them everywhere, not just in one corner of the platform.

Today, our detection teams operate across endpoint, cloud, NG-SIEM, identity, and SaaS security. They're individually strong. But threat actors don't respect domain boundaries, a supply chain attack lands on macOS, pivots through cloud credentials, and exfiltrates via a compromised SaaS app. We need someone who sees the full picture and turns it into detection coverage that outlasts any single campaign.

This function will report directly to the Sr Director of Engineering of the Detection Content Platform Group. This is a high visible, high impact role that will help us solve one of the hardest problems in cybersecurity: making an entire platform detect threats coherently, across every surface, at the speed adversaries operate. Threat actors are AI-force-multiplied, they stand up campaigns in hours and generate permutations on the fly. We need to detect and respond at the same scale and velocity.

What You’ll Do:

• Own cross-domain detection strategy. Maintain visibility into the detection team's work, endpoint (Windows, macOS, Linux), cloud (AWS, GCP, Azure, Kubernetes), NG-SIEM, identity (IDP), SaaS security (Adaptive Shield), and FEM. Identify where the same attack scenario has coverage on one surface but gaps on another, and work with the teams to close those gaps systematically.
• Design high-fidelity correlation detections. Build detection logic that joins signals across domains, entity resolution, temporal reasoning, behavioral layering. Deliver high-severity, low-FP detections via Platform IOAs (CDE) that resist bypass and remain effective over time.
• Drive threat-informed prioritization. Monitor internal and external intel sources. Partner with OverWatch, Falcon Complete, product managers across all modules, and customer success teams. Translate threat landscape shifts into concrete detection investment decisions. Top threat scenarios get deep, multi-domain coverage before they hit customer environments.
• Coordinate cross-team detection development. When a researcher writes a detection for a scenario on one platform, ensure coverage ships across all relevant surfaces simultaneously. No detection ships in isolation when the scenario spans domains.
• Apply AI/LLM to detection workflows. Identify opportunities to use automation and large language models to accelerate gap analysis, triage threat intel, and prototype correlation logic. Drive adoption of AI-assisted workflows across the detection engineering function.
• Coach and enable detection engineers across teams. Set technical direction. PR reviews, hands-on technical coaching, co-development on hard problems. Raise the bar for what "good detection" means across the organization.
• Influence product and platform direction. Identify gaps in telemetry, event coverage, or platform capabilities that limit detection quality. Work with sensor teams, product management, and platform engineering to close those gaps.