Director of AI/ML Detection Engineering Operations

About the Role:

For you to join the mission.  At CrowdStrike we’re on a mission - to stop breaches. Our groundbreaking technology, services delivery, and intelligence gathering together with our innovations in machine learning and behavioral-based detection, allow our customers to not only defend themselves, but do so in a future-proof manner. We’ve earned numerous honors and top rankings for our technology, organization and people – clearly confirming our industry leadership and our special culture driving it.

Data Science Machine Learning Operations and Response

CrowdStrike’s Machine Learning Operations and Response is at the core of Falcon’s machine learning malware detection and response capabilities. As a Machine Learning Operations and Response team member, you'll drive improvements to our machine learning and behavioral protection capabilities. Help us stop breaches with your expertise.

The opportunity: Our CrowdStrike Data Science Machine Learning Operations and Response are seeking an experienced and strategic Director of AI/ML Detection Engineering Operations to lead a high-performing team focused on building and operationalizing advanced threat detection capabilities across endpoint and cloud environments. This leader will drive innovation in AI and ML detection engineering, incident response support, and threat-informed defense strategy while collaborating closely with Falcon Complete and Counter Adversary Operations leaders, engineering teams, and executive stakeholders.

What You’ll Do:

• Lead and grow a global team of detection engineers focused on threat identification across endpoints, cloud infrastructure, and hybrid workloads

• Own the end-to-end lifecycle of detection engineering operations—from threat intelligence integration to rule deployment, tuning, and validation

• Analyze security data, threat intelligence, and other information to detect gaps or improvement opportunities in CrowdStrike’s detection capabilities and readiness against adversaries.

• Collaborate with leaders to prioritize detection gaps, align on coverage strategy, and integrate detection outputs into investigation and response workflows

• Establish and track KPIs for detection efficacy, fidelity, coverage, and operational efficiency.

What You’ll Need:

• At least 10 years of cybersecurity, information security, threat research, threat intelligence, or other relevant experience, with at least 5 in detection engineering, incident response, or threat hunting.

• Experience leading information or cyber security teams such as threat intelligence, detection engineering, or blue/purple/red teams.

• Comprehensive understanding of the security methodologies, technologies, and best practices.

• Ability to grasp abstract problems and reason about solutions to solve them.

• Solid background collaborating with or leading Security Operations Centers (SOCs), including working with alert triage pipelines and escalations

• Expertise in building and managing detection operations in endpoint (e.g., EDR, XDR) and cloud (e.g., AWS, Azure, GCP) environments.

• Hands-on understanding of attacker TTPs, MITRE ATT&CK, and behavior-based detection design.

Bonus Points:

• Offensive security, cloud, or cyber defense certifications.

• Threat intelligence or threat detection and response experience.

• Experience integrating or using AI/ML-driven detection capabilities.

• Experience collaborating with international teams.

• Experience in a specific industry or domain (e.g., financial services, healthcare, critical infrastructure)

• Familiarity with security data engineering (e.g., log normalization, enrichment, SIEM ingestion pipelines)

#LI-Remote

#LI-JP2