> Markdown version of [/jobs/ext/4694769-l2-security-operations-engineer-crowstrike](https://www.wearedevelopers.com/jobs/ext/4694769-l2-security-operations-engineer-crowstrike). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # L2 Security Operations Engineer Crowstrike - **Company:** TEKSYSTEMS INC. - **Location:** Austin, TX, United States - **Experience:** Expert - **Salary:** $114,400 - $135,200 - **Contract:** Temporary to permanent - **Skills:** ServiceNow Security Operations, Microsoft Windows, Active Directory, Application Programming Interfaces (APIs), Artificial Intelligence, Antivirus Softwares, Microsoft Antivirus, User Authentication, Microsoft Azure, Software as a Service, Cloud Computing, Cloud Computing Security, Cyber Security, Information Engineering, Multi-Factor Authentication, Statistical Hypothesis Testing, Intrusion Detection and Prevention, Python (Programming Language), Microsoft Security Essentials, Language Modeling, Parsing, Windows PowerShell, Azure Active Directory, Anti-Phishing, Runbook, Security Information and Event Management, Mitre Att&ck, Cyber Threat Analysis, Palo Alto Networks, Microsoft Sentinel, Api Design, SailPoint, Splunk, Security Orchestration, Automation & Response, Servicenow - **Published:** November 12, 2026 - **Apply:** https://www.careercircle.com/jobs/all/all/usa/tx/austin/ee520092-271d-4c1f-a3f1-53ef245940ad ## About the Role Preferred Qualifications 5+ years of Cyber/SOC experience, including incident response or detection engineering. Hands-on experience with CrowdStrike Falcon, including Falcon Insight, Next-Gen SIEM, and Falcon Fusion SOAR. Experience with Microsoft Sentinel and Microsoft Defender XDR, or with migrating between security platforms. Exposure to Splunk, Proofpoint, SailPoint, Palo Alto Networks, Rapid7, or ServiceNow Security Operations. Experience in financial services or another regulated industry. Experience using approved large language model or AI-assisted tools for investigation, analysis, documentation, or automation., Crowdstrike, Microsoft Defender, Security, Security operations, SIEM, SOAR, Palo Alto, Splunk, Entra ID, Incident response, telemetry, thresholds, Individual compensation offered for this position within this range will depend on many factors, including qualifications, skills, relevant experience, job knowledge, geographic location, internal equity, and other pertinent job-related factors. ## Description Rapid7 Falcon Tooling Parsing Coaching Phishing Timelines Operations Automation ServiceNow IdentityIQ Peer Review Investigation Microsoft 365 Cloud Security Azure Sentinel Medical Records Authentications Active Directory Data Engineering Windows Defender Incident Response Windows PowerShell Business Valuation Financial Services Workflow Management Process Improvement Evidence Preservation Full Stack Development Large Language Modeling Business Transformation Stakeholder Coordination Cyber Threat Intelligence Multi-Factor Authentication Software As A Service (SaaS) Business Continuity Planning Microsoft Defender Antivirus Python (Programming Language) Endpoint Detection And Response Troubleshooting (Problem Solving) Application Programming Interface (API) Security Information And Event Management (SIEM), Security Monitoring & Investigation Serve as the L2 escalation point for alerts across endpoint, identity, cloud, network, email, and application sources. Correlate logs and evidence across multiple tools to determine scope, severity, and likely impact. Independently investigate complex or escalated events using hypothesis-driven analysis; rapidly identify root cause, attack path, scope, severity, and business impact. Escalate high-impact or unresolved activity with clear evidence and recommendations, and maintain complete, defensible case notes, timelines, and incident records. Incident Response Lead technical response for assigned incidents, including scoping, containment, remediation, recovery validation, evidence preservation, and stakeholder coordination. Investigate phishing, credential compromise, malware, account takeover, privileged-access, and insider-risk scenarios, applying sound judgment when conditions fall outside established playbooks. Identify affected users, systems, identities, applications, and data sources, and contribute root-cause findings and lessons learned to post-incident reviews. Identity, Email, Endpoint & Cloud Security Analyze suspicious authentication, Microsoft Entra ID, Active Directory, multi-factor authentication, and privileged-account activity. Investigate user-reported phishing and coordinate remediation and follow-up. Analyze CrowdStrike Falcon endpoint detection and response alerts and security events across Microsoft 365, cloud, and SaaS platforms; support evaluation and adoption of Microsoft security tooling as the platform strategy evolves. SIEM Data Engineering & Detection Enhancement Engineer, onboard, and maintain security data feeds to the SIEM, including log source configuration, parsing, normalization, field mapping, and timestamp integrity. Monitor data-source health and troubleshoot ingestion gaps, delays, and quality issues before they affect detection coverage. Translate investigation findings, threat intelligence, and MITRE ATT&CK coverage analysis into tested detection and alerting improvements. Tune detections to reduce false positives and improve alert fidelity; submit all detection changes for peer review before deployment. SOAR & Automation Design, tune, test, and maintain SOAR playbooks and integrations that enrich alerts, automate repeatable investigation steps, and accelerate response. Improve SOAR accuracy and efficiency by measuring playbook outcomes, eliminating failure points, and preserving appropriate validation, auditability, and analyst control. Develop PowerShell, Python, or API-based automation that reduces manual effort and expedites troubleshooting; all automation changes are peer reviewed. Use approved AI-assisted tools to enrich investigations, summarize evidence, and improve analyst efficiency. L1 Support & Process Improvement Provide occasional coaching and guidance to L1 analysts through case reviews, escalation feedback, and knowledge sharing. Improve runbooks, knowledge articles, escalation criteria, and SOC workflows based on operational metrics and lessons learned. Participate in on-call rotation as needed, outside of standard business hours.