Security Engineer, CrowdStrike

Opportunity Summary

SP6 is seeking a full-time consultant to join our services teams in North America.

Falcon is much more than endpoint detection and response (EDR). It is a unified security platform spanning endpoint, identity, cloud, data protection, SIEM, and AI security. This role focuses on two of its fastest-growing areas: Falcon Next-Gen SIEM (Falcon NG-SIEM) and Falcon AI Detection and Response (AIDR), with hands-on work across Falcon Fusion SOAR, Falcon Onum, and Falcon Foundry.

You will be a hands-on expert for our customers and a technical resource for our own team, answering questions and cross-training colleagues as our CrowdStrike practice grows. Consultants work on many use cases across different industries and multiple Falcon modules.

Responsibilities

You'll support customers through two delivery models, often working with several customers at once:

• Professional services:
• Residency engagements: longer-term engagements embedded with a customer, typically lasting from a few months to a year
• Outcome-based engagements: project work with defined milestones and deliverables delivered within an agreed timeline
• Managed services: ongoing, recurring support in which SP6 operates and maintains the customer's Falcon environment as an extension of their security team
• Architect, deploy, and tune Next-Gen SIEM: onboard data sources, build parsers, write detections and dashboards, and support migrations from other SIEMs
• Help customers adopt AIDR (Guardian) to secure workforce AI usage and in-house AI applications and agents
• Design and configure playbooks, workflows, and integrations in Fusion SOAR
• Design and configure in Falcon Onum listeners, pipelines and datasinks
• Design and configure custom apps for custom applications using Falcon Foundry
• Lead deployments, migrations, health checks, and outcome-based projects from requirements gathering through handoff
• Provide ongoing administration of customers' Falcon environments, including policy and sensor management, detection tuning, platform health monitoring, and regular reporting against service levels
• Leverage previous experience, share best practices, and create innovative solutions that maximize customers' value from Falcon and aid in user adoption
• Provide knowledge transfer to customers throughout each engagement
• Serve as a hands-on CrowdStrike resource for our internal team, answering technical questions and cross-training colleagues
• Manage your time across multiple concurrent customers, setting clear expectations and keeping each engagement moving
• Develop and continually extend expertise across the Falcon platform and the broader security landscape

Requirements

• Hold active CrowdStrike certifications: CrowdStrike Certified Falcon Administrator (CCFA) and CrowdStrike Certified SIEM Engineer (CCSE)
• 1+ years of hands-on CrowdStrike Falcon experience, including Next-Gen SIEM
• Preferably has experience with AIDR
• 3+ years of cybersecurity experience, preferably in SOC operations, security engineering, threat detection, or incident response
• Understanding of security log sources, normalization, correlation, and detection dependencies.
• Working knowledge of MITRE ATT&CK, NIST CSF, OWASP and incident response processes
• Strong understanding of security technologies: EDR/XDR, firewalls, IDS/IPS, WAF, DNS, proxy, IAM, Active Directory, and cloud security.
• Experience writing queries, detections, and dashboards in CrowdStrike Query Language (CQL)
• Experience in requirements gathering, documenting requirements, requirement analysis, and testing
• Proven ability to manage multiple customers or projects at the same time, in a project-based or ongoing managed services setting
• Excellent verbal and written communication skills, including explaining technical topics to non-technical audiences

Benefits

Why SP6?

• The chance to lead a team in a high-growth markets
• Competitive salary
• Quarterly Bonus plan
• Comprehensive medical, dental, and vision plans.
• 401(k) with company match
• 30 days annual paid time off
• Significant Training and Development and Certification attainment.
• Opportunity for long-term career advancement.
• Your contributions are felt and recognized at our growing company

AI use made Secure, Compliant, Resilient

SP6 ensures that organizations get Beyond the Buzzwords ® and delivers Expert Services centered around (3) convergent areas: AI Governance, AI Security, and AI Systems Resiliency. SP6 leads organizational initiatives around:

• AI Governance, Risk & Compliance Services
• Establishing and enhancing controls around the safe use of AI via Subject Matter Experts on leading industry frameworks including ISO 42001, NIST AI RMF, and CSA AI Control Matrix.
• Evaluating organizations’ adherence to these standards, whether that be for self-monitoring of controls to mitigate risk or adherence to regulatory requirements including the EU AI Act, various state insurance regulation tied to the NAIC Model Bulletin, and other statutory requirements.
• AI Security
• Hands-on implementation (tooling, training, technical controls) to operationalize organizational standards.
• This technical tool advisement and configuration work becomes both the connective tissue to policy as well as the assurance of risk mitigation, from monitoring AI usage (both sanctioned and shadow) and configuring network, endpoint, DLP, SIEM, and other tools with practical defensive security measures.
• AI System Resiliency
• Ensuring that systems or services that are AI-led are behaving as expected, providing an uninterrupted and seamless user experience.
• This practice area also assists clients with managing and reducing unnecessary AI token spend.

These services co-exist with legacy expertise and services from SP6 in the Security Operations (SIEM), as the SIEM is an organization’s primary tool for security detection and analysis; as well as our existing Cyber Compliance expertise in Cyber Risk & Compliance (CRC) services.