CroudStrike Architect

Position Overview

Key Responsibilities

• Platform Architecture: Architect and manage multi-tenant CrowdStrike environments (CID hierarchy, RBAC, policy groups, host health) across Windows, Linux, and macOS.
• Tier 3 Incident Escalation: Lead containment, forensics, and live response via Real-Time Response (RTR); create custom IOAs/IOCs.
• Integrations & Automation: Connect Falcon telemetry with SIEM/SOAR platforms (Splunk, Sentinel, Cortex) and automate playbooks via CrowdStrike Fusion SOAR.
• Dashboards & APIs: Build custom dashboards using CrowdStrike APIs to report vulnerability data and critical operational metrics.

Key Skills & Qualifications

• CrowdStrike Platform Mastery: 4+ years engineering and managing Falcon at scale (10,000+ endpoints).
• Incident Response & Forensics: Real-Time Response (RTR), threat hunting, and custom rule creation (IOAs/IOCs).
• Scripting: PowerShell, Python, or Bash for remediation and API integration.
• Ecosystems & Frameworks: Active Directory / Entra ID, Network Security, and MITRE ATT&CK mapping.

• Must hold at least ONE active CrowdStrike Certification: CCFA, CCFR, or CCFH.
• Must hold an active Industry Certification: CISSP, GCFA, GCIH, GSEC, or CISA.

• State/Local Government (SLTT) or enterprise multi-tenant environments.
• Compliance frameworks: NIST SP 800-53, CJIS, HIPAA, or IRS Pub 1075.