Detection Engineer, Falcon Complete (Remote, CAN)

Description

The company is a cybersecurity firm that protects organizations' people, processes and technology, and its platform handles close to 3 trillion events per day, with that volume rising every day.

The Falcon Complete Detection Engineering team builds and maintains the next-gen SIEM detection ruleset behind the company's managed detection and response service.

The team writes high-fidelity detections from threat intelligence and real-world activity, responds quickly to zero-days and new threats, and fills gaps across many third-party data sources where attackers are increasingly active.

The team also builds AI-powered tools that speed up detection development at scale, and engineers work across the pipeline from ingestion and parsing through to response and automation to triage faster and disrupt threats sooner.

Responsibilities

• Research threats and hunt for new attacker tactics, techniques, and procedures (TTPs), then turn your findings into intelligence-led detections.
• Write, test and release high-fidelity next-gen SIEM detection rules that give the managed detection and response team strong coverage.
• Review code and test rules so they meet quality and performance standards before they go out at scale.
• Apply CI/CD practices to ship detections as code.
• Build and use AI-assisted detection tooling, including LLM tools and coding agents, to speed up research, rule writing and workflow automation.
• Work with SIEM architects to set best practices for parsing data and mapping it to a common event schema.
• Build and maintain utilities that help the managed services team work efficiently at scale.
• Write and keep up processes and documentation.
• Take part in an on-call rotation as a detection engineer handler.

Requirements

• You should have experience in many of the areas below.
• At least 3+ years working as a detection engineer, security engineer, security analyst, threat intelligence analyst, or in a related role.
• Up-to-date knowledge of current cyber threats and how to detect them with SIEM and related technologies.
• Industry certifications such as GCFA, GCDA or GCIH are relevant.
• Experience analyzing large datasets from a range of vendors and technologies.
• Experience with SIEM platforms such as LogScale, Splunk, SumoLogic, Sentinel, QRadar or LogRhythm.
• Familiarity with large language models (LLMs) and AI coding agents. Hands-on experience building or integrating LLM-assisted workflows is a plus.
• Python or other scripting experience is strongly preferred.
• A curious, self-driven approach and high standards for your own work.
• A proven record of using AI to improve decisions, streamline workflows and processes, raise efficiency and drive business results.

Conditions

This is a remote role based in Canada, employed by the company Canada ULC.

You must have the legal right to work in Canada.

Candidates who move forward will undergo background checks, which may include criminal record, credit and/or reference checks.

The base salary range is $105,000 - $145,000 CAD per year, plus variable incentive compensation, equity and benefits. Final pay depends on factors such as relevant experience, skills, certifications and location.

The company is committed to equal pay for equal work and to equal employment opportunity for all applicants.

Benefits

• Compensation and equity awards that the company describes as market-leading.
• Comprehensive physical and mental wellness programs.
• Competitive vacation and holiday time.
• Paid parental and adoption leave.
• Professional development open to everyone, regardless of level or role.
• Employee networks, neighborhood groups and volunteer opportunities.
• An office with well-equipped amenities for those who work on site.
• Great Place to Work certification across the company's global locations.