Software Detection Engineer - Cloud, Identity Protection (Hybrid, ISR)

You will build globally distributed, fault-tolerant, and highly scalable identity threat detection systems that analyze billions of authentication events per day to detect sophisticated Active Directory attacks, credential theft, and lateral movement across hybrid and multi-cloud (Azure/Entra, Okta, AWS) environments. You'll design, lead, and implement the next generation of CrowdStrike's Identity Protection detection platform - evolving it from on-prem appliances toward cloud-native, event-streaming microservices.

What You'll Do

Design and implement real-time detection rules and pipelines over high-throughput Kafka event streams, maintaining sub-second detection latency at massive scale.

Build the pluggable detection engine and rule framework that turns raw authentication telemetry into indicators, and indicators into enriched, customer-facing alerts.

Develop machine-learning and behavioral-anomaly models, and integrate LLM-based detection reasoning (e.g. AI-driven severity scoring) into production detection flows.

Translate security research into production-grade detections, partnering with security researchers who guide you on the threat landscape.

Own detections in production: observability, latency SLOs, safe per-customer rollouts (feature-flag-gated), and incident response for the detection pipeline.

Work across a polyglot stack - Python for detection logic and ML, Go for the high-performance streaming services, Java for backend alert management.