Senior Security Operations Engineer

Provide senior technical expertise to maintain and strengthen security operations during organizational changes, with immediate responsibility for CrowdStrike Falcon platform management, threat hunting, detection engineering, and incident response.

Core Responsibilities

CrowdStrike Falcon Platform Engineering: Deep hands-on expertise administering, configuring, troubleshooting, and optimizing Falcon Endpoint Complete, Next Gen SIEM, Falcon Shield, Identity Threat Protection, and Falcon Cloud Security Complete. Manage policies, integrations, detection configurations, platform health, and operational issues.

Advanced Threat Hunting: Independently conduct proactive, hypothesis driven threat hunts across endpoint, identity, cloud, and network telemetry. Strong knowledge of MITRE ATT&CK, attacker techniques, lateral movement, credential abuse, persistence, and data exfiltration. Advanced proficiency in CrowdStrike Query Language (CQL), KQL, and scripting with Python and PowerShell to develop hunting queries, analyze telemetry, and automate investigations.

Digital Forensics and Incident Response (DFIR): Lead technical investigations involving endpoint compromise, identity attacks, malware, ransomware, and cloud security incidents. Perform forensic evidence collection, memory and disk analysis, attack reconstruction, root cause analysis, containment, eradication, and recovery. Experience with Falcon Real Time Response and forensic investigation tools.

Detection Engineering and SIEM Operations: Develop, test, and tune custom detection rules, correlation logic, and alerts using Falcon Next Gen SIEM. Manage log ingestion, data parsing, integrations, and telemetry quality. Identify detection gaps, reduce false positives, and improve visibility across enterprise systems.

Security Automation and Integration: Develop Python, PowerShell, and API based integrations to automate investigations, threat intelligence enrichment, response actions, and operational workflows. Experience with Falcon Fusion SOAR, REST APIs, and integration with Microsoft security technologies.

Incident Escalation and Operational Support: Serve as senior technical escalation resources for complex security incidents, working directly with CrowdStrike Falcon Complete and OverWatch teams. Validate detections, investigate escalations, coordinate response actions, and maintain operational continuity.

Required Technical Experience

10+ years of hands on security operations, incident response, or security engineering experience.

3+ years of direct CrowdStrike Falcon administration and engineering experience, with demonstrated expertise in multiple Falcon modules.

Advanced proficiency in CQL, Python, PowerShell, and security telemetry analysis.

Strong knowledge of Windows, Linux, Active Directory, Microsoft Entra ID, Microsoft 365, and Azure security.

Demonstrated experience conducting independent threat hunts and complex forensic investigations.

Experience with SIEM engineering, custom detections, log ingestion, and security automation.

Ability to independently troubleshoot and resolve technical issues without relying on vendor support for routine operations.

CrowdStrike certifications such as CCFA, CCFR, or CCFH preferred.