Work Arrangement: Remote (Base: Des Moines, IA)
Shift: EST
Interview Process: Web Cam or In-Person Interview
Position Overview
Serve as the primary technical authority and highest escalation tier (Tier 3) for an enterprise CrowdStrike Falcon (EDR/XDR) ecosystem. This role focuses on platform architecture, advanced threat hunting, incident containment, and complex security tool integrations.
Key Responsibilities
Platform Architecture: Architect and manage multi-tenant CrowdStrike environments (CID hierarchy, RBAC, policy groups, host health) across Windows, Linux, and macOS.
Tier 3 Incident Escalation: Lead containment, forensics, and live response via Real-Time Response (RTR); create custom IOAs/IOCs.
Integrations & Automation: Connect Falcon telemetry with SIEM/SOAR platforms (Splunk, Sentinel, Cortex) and automate playbooks via CrowdStrike Fusion SOAR.
Dashboards & APIs: Build custom dashboards using CrowdStrike APIs to report vulnerability data and critical operational metrics.
Key Skills & Qualifications
Required Technical Skills:
CrowdStrike Platform Mastery: 4+ years engineering and managing Falcon at scale (10,000+ endpoints).
Incident Response & Forensics: Real-Time Response (RTR), threat hunting, and custom rule creation (IOAs/IOCs).
Scripting: PowerShell, Python, or Bash for remediation and API integration.
Ecosystems & Frameworks: Active Directory / Entra ID, Network Security, and MITRE ATT&CK mapping.
Required Certifications:
Must hold at least ONE active CrowdStrike Certification: CCFA, CCFR, or CCFH.
Must hold an active Industry Certification: CISSP, GCFA, GCIH, GSEC, or CISA.
Preferred Experience:
State/Local Government (SLTT) or enterprise multi-tenant environments.
Compliance frameworks: NIST SP 800-53, CJIS, HIPAA, or IRS Pub 1075.