CrowdStrike EDR SME /Senior Architect

Crowdstrike Edr Subject Matter Expert (Sme) – Senior Architect We are seeking a highly experienced CrowdStrike EDR Subject Matter Expert (SME) – Senior Architect to lead the optimization, governance, and enhancement of the CrowdStrike Falcon platform. This role requires deep expertise in EDR administration, detection engineering, incident response, Splunk integration, and SOAR automation, along with strong knowledge of the MITRE ATT&CK framework. The role focuses on CrowdStrike EDR Optimization, improving detection fidelity, operational maturity, and EDR governance. Project: Crowdstrike Edr Optimization Evaluate and enhance existing CrowdStrike detection rules for improved coverage and effectiveness Replace low-fidelity Windows Event Log detections with Custom CrowdStrike IOA-based rules Develop and formalize a comprehensive CrowdStrike operational framework and governance model Analyze CrowdStrike telemetry and optimize Splunk log ingestion to reduce redundant and low-value events Key Responsibilities 1. Edr & Crowdstrike Administration Design, implement, and maintain Custom IOA rules aligned with MITRE ATT&CK Manage Falcon sensor lifecycle: deployment, upgrades, health monitoring, and troubleshooting Administer and optimize CrowdStrike modules: Endpoint Protection Platform (EPP) Identity Protection (IDP) Threat Intelligence & Prevention Policies Perform policy configuration and controlled rollouts across Production and Non-Production environments 2. Detection Engineering & Use Case Development Migrate low-fidelity Windows event detections to high-fidelity CrowdStrike IOA detections Build and maintain Splunk detection use cases using endpoint telemetry Tune detection rules to reduce false positives while maintaining strong threat coverage Develop detection logic for: Persistence Execution Lateral movement Privilege escalation 3. Incident Response & Containment Conduct endpoint investigations using the CrowdStrike Falcon console Perform host containment, process termination, file quarantine, and RTR actions Support SOC and IR teams during active incidents with forensic-level endpoint analysis 4. Ioc & Threat Intelligence Management Manage IOC ingestion, validation, and lifecycle (hashes, IPs, domains) Correlate threat intelligence feeds with endpoint telemetry Ensure IOC policies are properly scoped to prevent business disruption Argyle Infotech