Cyber Security Engineer/Principal Security Engineer/Senior Threat Detection Engineer

100% Remote

1 year contract-Night Shift

Total at least 10+ years of experience required

Required Skills & Experience

- 5+ years in detection engineering, threat hunting, or security operations.
- Splunk, Microsoft Sentinel, CrowdStrike 'NextGen SIEM') and SOAR.
- Cloud security across AWS and/or Azure, including secure architecture and workload protections.
- Detection engineering & automation: rule authoring/tuning, query languages (FQL/CQL, KQL, SPL), and scripting (Python/PowerShell).
- Nice to Have Skills & Experience
- Expertise in data pipeline optimization (Cribl or similar) for log normalization and enrichment.
- Experience with SaaS security posture management and UEBA for cloud apps.
- Exposure to OT/xOT security and industrial network monitoring.
- Certifications such as CISSP, GIAC (GDSA/GMON/GCIA), OSCP, CCSK/CCSP, or vendorspecific cloud/security certs.
- Familiarity with AI/ML security concepts and adversary emulation techniques.
- Threat intelligence integration: correlating IOCs, leveraging TI platforms, and supporting proactive detection.




- Secure API design and testing aligned with OWASP API Top 10.

We are seeking a highly experienced Senior Detection Engineer to lead the development and optimization of advanced threat detection and response capabilities across endpoint, identity, cloud, SaaS, and OT/xOT environments. This role requires deep expertise in the CrowdStrike ecosystem (Falcon Endpoint, Next-Gen SIEM, Identity Protection (IDP), FUSION), SOAR platforms, and cloud security. You will serve as the CrowdStrike SME—owning sensor deployment, troubleshooting, automation, and query development—while partnering with SOC, Cloud, Infrastructure, and Application teams to measurably reduce risk and drive secure architecture and engineering initiatives. Build cloud detections for AWS/Azure/GCP and integrate cloudnative logs and controls.

- Engineer the telemetry pipeline with Cribl: normalize, enrich, and route data to SIEM.
- Operate the CrowdStrike stack endtoend: sensor deployment/health, telemetry gaps, escalations; Partner with Infra/Cloud/SOC to harden endpoints, identity, and M365/SaaS security configurations.

📌 Cyber Security Engineer - Remote (India)
🏢 Sapphire Software Solutions
📍 India