CroudStrike Architect

Work Arrangement: Remote (Base: Des Moines, IA)

Shift: EST

Interview Process: Web Cam or In-Person Interview

Serve as the primary technical authority and highest escalation tier (Tier 3) for an enterprise CrowdStrike Falcon (EDR/XDR) ecosystem. This role focuses on platform architecture, advanced threat hunting, incident containment, and complex security tool integrations.

• Platform Architecture: Architect and manage multi-tenant CrowdStrike environments (CID hierarchy, RBAC, policy groups, host health) across Windows, Linux, and macOS.

• Tier 3 Incident Escalation: Lead containment, forensics, and live response via Real-Time Response (RTR) ; create custom IOAs/IOCs .

• Integrations & Automation: Connect Falcon telemetry with SIEM/SOAR platforms (Splunk, Sentinel, Cortex) and automate playbooks via CrowdStrike Fusion SOAR .

• Dashboards & APIs: Build custom dashboards using CrowdStrike APIs to report vulnerability data and critical operational metrics.

Required Technical Skills:

• CrowdStrike Platform Mastery: 4+ years engineering and managing Falcon at scale (10,000+ endpoints).

• Incident Response & Forensics: Real-Time Response (RTR), threat hunting, and custom rule creation (IOAs/IOCs).

• Scripting: PowerShell , Python , or Bash for remediation and API integration.

• Ecosystems & Frameworks: Active Directory / Entra ID, Network Security, and MITRE ATT&CK mapping.

Required Certifications:

• Must hold at least ONE active CrowdStrike Certification: CCFA , CCFR , or CCFH .

• Must hold an active Industry Certification: CISSP , GCFA , GCIH , GSEC , or CISA .

Preferred Experience:

• State/Local Government (SLTT) or enterprise multi-tenant environments.

• Compliance frameworks: NIST SP 800-53 , CJIS , HIPAA , or IRS Pub 1075 .