REMOTE : CrowdStrike Architect

Job Title: Senior Tier 3 CrowdStrike Architect

Location: Remote Des Moines, IA

We are seeking a Senior Tier 3 CrowdStrike Architect to serve as the technical authority for an enterprise CrowdStrike Falcon EDR/XDR platform supporting a large, multi-tenant environment.

Key Responsibilities:

• Architect and administer CrowdStrike Falcon across multi-tenant environments, including RBAC, policies, host groups, sensors, and platform tuning.
• Provide Tier 3 incident response, advanced threat hunting, endpoint containment/remediation, and Real-Time Response (RTR).
• Develop custom IOCs/IOAs and automate security response using CrowdStrike Fusion/SOAR.
• Integrate CrowdStrike with SIEM/SOAR, threat intelligence, network security, and automation platforms.
• Develop scripts using PowerShell, Python, and Bash for remediation and API integrations.
• Support Windows, Linux, and macOS endpoint security environments.
• Develop CrowdStrike API dashboards, SOPs, deployment guides, and security documentation.
• Mentor Tier 1/2 SOC teams and collaborate with CrowdStrike engineering/TAMs.

Required:

• 4+ years of enterprise-scale CrowdStrike Falcon engineering experience, preferably supporting 10,000+ endpoints.
• Strong experience with RTR, threat hunting, custom IOAs/IOCs, and Tier 3 incident response.
• Strong Windows/Linux/macOS and PowerShell/Python/Bash skills.
• Knowledge of AD/Entra ID, network security, vulnerability management, patching, and MITRE ATT&CK.
• Must hold at least one active CrowdStrike certification (CCFA, CCFR, or CCFH) plus an advanced security certification such as CISSP, GCFA, GCIH, GSEC, or CISA.
• State/local government, higher education, or large multi-tenant enterprise experience is highly preferred.