Defender for Cloud Engineer
OpenKyber LLC · Atlanta, GA, United States ·
COMPENSATION
€•• – ••k
Listed on WeAreDevelopers
- Senior SOC Engineer
- CrowdStrike + Torq
- AI/LLM Integration
- Fully Remote (US)
- Government Sector
The Office of the Attorney General seeks a senior-level expert to enhance detection, response, and orchestration capabilities. You will blend SOC investigative expertise with security automation engineering, focusing on scalable workflows using CrowdStrike Falcon and Torq.
This role requires integrating large language model tools like Claude into security operations for triage and playbook generation. You must operate within a strict Zero Trust posture appropriate for a government legal environment, ensuring all data handling meets regulatory standards.
What you'll do
- Serve as Tier 3 escalation point for complex security incidents and threat hunting
- Design and maintain detection analytics and dashboards using Falcon Query Language
- Architect SOAR playbooks in Torq to automate response workflows across platforms
- Create AI-assisted analyst workflows for triage and enrichment with sanitized data
- Lead incident response for high-severity events coordinating with legal and IT stakeholders
- Develop documentation, runbooks, and SOPs for Tier 1 and Tier 2 analysts
- Mentor junior SOC analysts and validate their investigative work quality
- Participate in an on-call rotation for critical incident escalations
What you'll need
- 8+ years in SOC/security operations with 2+ years at Tier 3 or detection engineering level
- Hands-on production experience with CrowdStrike Falcon including custom detection authoring
- Proven experience building or maintaining SOAR automation, preferably with Torq
- Practical use of AI/LLM tools like Claude or GPT in regulated security environments
- Working knowledge of Zero Trust architecture and frameworks like IRS Pub. 1075 or HIPAA
- Strong scripting ability in PowerShell, Python, or Falcon Query Language for automation
- Excellent written communication skills for incident reporting and cross-divisional coordination
- Bachelor's degree in Computer Science, Information Security, or equivalent experience
Nice to have
- GIAC certifications such as GCIH, GCIA, or GCFA
- CrowdStrike Certified Falcon Responder or Administrator credentials
- Torq certification or portfolio of built automation workflows
- Experience designing AI-assisted playbooks with strict data-handling guardrails
- Familiarity with Microsoft Defender XDR, Splunk, Entra ID, or Tenable One
- Background in government, legal, or law-enforcement-adjacent security environments
Stack
- CrowdStrike Falcon
- Torq
- Claude
- GPT
- Python
- PowerShell
- Splunk
- Microsoft Defender XDR
- Entra ID Protection
- Tenable One
How you'll work
- On-call rotation for critical incidents
- Cross-functional collaboration with IT and legal teams
- Strict adherence to FTI/CJI handling restrictions