Senior Tier 3 CrowdStrike Architect

Location: Des Moines, IA Remote
Job Type: Long-Term Contract
Experince: 10+ Years

Job Summary

We are seeking a Senior Tier 3 CrowdStrike Architect to serve as the technical authority for an enterprise CrowdStrike Falcon EDR/XDR environment supporting 10,000+ endpoints. The role will focus on Falcon architecture, Tier 3 incident response, threat hunting, automation, integrations, and platform administration.

Mandatory Skills & Experience

• 4+ years of hands-on CrowdStrike Falcon experience in an enterprise environment with 10,000+ endpoints.
• Strong experience with CrowdStrike Falcon architecture, administration, RBAC, policies, host groups, sensor deployment, and platform tuning.
• Hands-on experience with CrowdStrike Real-Time Response (RTR).
• Strong Tier 3 Incident Response, endpoint threat hunting, malware investigation, containment, and remediation experience.
• Experience creating and managing custom IOCs and IOAs.
• Strong knowledge of Windows, Linux, and macOS internals.
• Strong scripting experience with PowerShell, Python, and/or Bash.
• Experience with CrowdStrike Falcon APIs and security automation.
• Experience integrating CrowdStrike with SIEM/SOAR platforms, such as Splunk, Microsoft Sentinel, or Palo Alto Cortex.
• Knowledge of network security, firewalls, IDS/IPS, Active Directory, Microsoft Entra ID/IAM, patch management, and vulnerability management.
• Strong understanding of the MITRE ATT&CK framework.
• Experience with CrowdStrike Fusion SOAR and automated response workflows is highly valuable.
• Strong communication, troubleshooting, stakeholder management, and mentoring skills.

Mandatory Certification

Candidate must hold at least one active certification:

• CrowdStrike Certified Falcon Administrator (CCFA)
• CrowdStrike Certified Falcon Responder (CCFR)
• CrowdStrike Certified Falcon Hunter (CCFH)
• OR CISSP, GCFA, GCIH, GSEC, CISA, or equivalent advanced security certification.

Preferred

• State/local government, higher education, or large multi-tenant enterprise experience.
• Knowledge of NIST SP 800-53, CJIS, HIPAA, or IRS Pub 1075.
• Experience with ITDR/CSPM security technologies.