Senior Tier 3 CrowdStrike Architect
Location: Des Moines, IA Remote
Job Type: Long-Term Contract
Experince: 10+ Years
Job Summary
We are seeking a Senior Tier 3 CrowdStrike Architect to serve as the technical authority for an enterprise CrowdStrike Falcon EDR/XDR environment supporting 10,000+ endpoints. The role will focus on Falcon architecture, Tier 3 incident response, threat hunting, automation, integrations, and platform administration.
Mandatory Skills & Experience
4+ years of hands-on CrowdStrike Falcon experience in an enterprise environment with 10,000+ endpoints.
Strong experience with CrowdStrike Falcon architecture, administration, RBAC, policies, host groups, sensor deployment, and platform tuning.
Hands-on experience with CrowdStrike Real-Time Response (RTR).
Strong Tier 3 Incident Response, endpoint threat hunting, malware investigation, containment, and remediation experience.
Experience creating and managing custom IOCs and IOAs.
Strong knowledge of Windows, Linux, and macOS internals.
Strong scripting experience with PowerShell, Python, and/or Bash.
Experience with CrowdStrike Falcon APIs and security automation.
Experience integrating CrowdStrike with SIEM/SOAR platforms, such as Splunk, Microsoft Sentinel, or Palo Alto Cortex.
Knowledge of network security, firewalls, IDS/IPS, Active Directory, Microsoft Entra ID/IAM, patch management, and vulnerability management.
Strong understanding of the MITRE ATT&CK framework.
Experience with CrowdStrike Fusion SOAR and automated response workflows is highly valuable.
Strong communication, troubleshooting, stakeholder management, and mentoring skills.
Mandatory Certification
Candidate must hold at least one active certification:
CrowdStrike Certified Falcon Administrator (CCFA)
CrowdStrike Certified Falcon Responder (CCFR)
CrowdStrike Certified Falcon Hunter (CCFH)
OR CISSP, GCFA, GCIH, GSEC, CISA, or equivalent advanced security certification.
Preferred
State/local government, higher education, or large multi-tenant enterprise experience.
Knowledge of NIST SP 800-53, CJIS, HIPAA, or IRS Pub 1075.
Experience with ITDR/CSPM security technologies.