Sr. Engineer (CrowdStrike Falcon)

XPT Software Australia Pty Ltd; Melbourne; On-site; AUD 83,000 - 124,000; Full time

Job summary

XPT Software Australia Pty Ltd in Melbourne is seeking a Senior Engineer to build, deploy and enhance CrowdStrike Falcon across endpoints and cloud environments. You will collaborate with SOC and cloud teams to improve detection and response, while delivering automation and secure integrations.

Senior specialist with hands-on Falcon engineering, Terraform, and cloud-native development will lead platform health, policy tuning and tooling improvements in a production setting.

Qualifications

• Hands-on production engineering of CrowdStrike Falcon deployments and policy configuration.
• Automation scripting and integration using Falcon APIs and Python/Java.
• Terraform for cloud configuration, modules and pipelines.
• GCP knowledge including IAM, compute, networking and secure workload integration.
• Kubernetes security concepts including clusters, namespaces, and runtime controls.

Responsibilities

• Build, configure and maintain Falcon components including sensor deployment and health, host groups, prevention and response policies, exclusions, access controls and update rings.
• Engineer Falcon coverage for GCP compute and Kubernetes workloads, integrating cloud accounts and sensor deployment.
• Create Terraform modules and deployment pipelines for Falcon resources and cloud integrations.
• Develop Python/Java integrations using Falcon APIs and enterprise interfaces; ensure event processing and authentication.
• Integrate detections and incidents into Google SecOps, ServiceNow and other approved workflows; validate data quality and tracing.

Tools

CrowdStrike Falcon

Terraform

Kubernetes

Python

Java

Google Cloud Platform

Job description

XPT Software Australia Pty Ltd | Contract

Melbourne, Australia | Posted on 11/05/2026

• XPT SoftwareAustralia PTY Ltd, incorporated in 2016, is a Software Services company
  
• XPT works with topclients across Australia in Banking, Insurance, Telecom,Retail, Energy, Mining and Manufacturingdomains.
  
• We have 120+technocrats in Australia working at our clientlocations.
  
• XPT SoftwareAustralia is part of group companies which has globalpresence across India & Europe.
  
• We have served100+ clients globally, fulfilling their onsite-offshoreneeds.
  

Job Description

Build, deploy and improve CrowdStrike Falcon platformcapabilities across endpoint and cloud environments. The role combines Falconplatform engineering with secure cloud-native development, integration andautomation, while partnering with the SOC and cloud teams to improve detectionand response outcomes.

Suggestedlevel

SeniorEngineer or experienced Engineer with demonstrable production ownership

Primaryaccountability

Falconplatform components, sensor coverage, policies, integrations, cloud workloadprotection, automation and platform health.

Keyinterfaces

CyberPlatforms TPO, SOC, cloud and Kubernetes teams, endpoint services,ServiceNow, identity, network and application teams.

Key Responsibilities:

• Build, configure and maintain Falcon componentsincluding sensor deployment and health, host groups, prevention and responsepolicies, exclusions, access controls and update rings appropriate to deployedlicences.
• Engineer reliable Falcon coverage for GCPcompute and Kubernetes workloads, partnering on cloud account integration,sensor or operator deployment, admission controls and image analysis where inscope.
• Create and maintain Terraform modules anddeployment pipelines for supported Falcon resources, cloud integration andKubernetes components.
• Build Python automation and, where required,Java services or integrations using Falcon APIs, SDKs, event streams andapproved enterprise interfaces.
• Integrate Falcon detections, incidents, assetand response data into Google SecOps, ServiceNow and other approved workflows;validate mapping, event quality, latency and case traceability.
• Design and tune detection and response policies,indicators and orchestration workflows with SOC analysts; measure coverage,noise, speed and operational impact.
• Evaluate AI-assisted triage and responsecapabilities with human review, approvals, auditability, test cases andfalse-positive safeguards before production use.
• Investigate platform health, sensor coveragegaps, policy conflicts and failed integrations; maintain runbooks, testevidence, change records and knowledge transfer.

Mandatory skills and experience:

• Hands-on production engineering of CrowdStrikeFalcon, including deployment, policy configuration, sensor lifecycle, hostgrouping, exclusions, RBAC and troubleshooting.
• Practical experience using Falcon APIs andPython for automation, workflow integration and event processing, includingauthentication, scopes, retries and failure handling.
• Terraform experience for repeatable platform andcloud configuration, with modules, state, pipelines, testing and driftmanagement.
• GCP knowledge covering organisations, projects,IAM, service accounts, compute, networking and secure workload integration.
• Kubernetes and container security knowledgecovering clusters, namespaces, images, admission controls, runtimeinstrumentation and controlled rollouts.
• Experience building or maintaining cloud-nativeintegrations in Python and Java, including APIs, testing, observability andsecure deployment.
• Understanding of endpoint and cloud threatdetection, policy tuning, incident response and SOC handoff.

Desirable skills and experience:

• Experience with Falcon Cloud Security, FusionSOAR, Foundry or Charlotte AI capabilities where deployed and licensed.
• CrowdStrike Terraform provider and Kubernetesdeployment module experience.
• Google SecOps, ServiceNow, vulnerabilitytooling, CI or CD and enterprise identity integration experience.
• Production Java development depth, especiallyevent-driven or containerised services.
• Experience in regulated financial services andplatform continuity.
• Documented Falcon platform baseline, componentinventory, policy map, integration map, sensor coverage and known gaps.
• Tested Terraform modules and pipelines forrepeatable configuration, GCP onboarding and Kubernetes coverage.
• Production-ready Python or Java integrationswith controls, tests, logs, monitoring, runbooks and ownership.
• Validated detection and response improvements,including AI-assisted workflow assessment with defined human control points.
• Coverage and health reporting, integration testresults, change records and a prioritised improvement backlog.

Assessmentarea

Evidenceexpected

Weight

Sensor,policy, platform health and API work, including contribution and scale.

30%

Cloud and IaC

GCP,Kubernetes and Terraform deployments, testing and release controls.

25%

Python andJava examples, API design, secure coding and operational support.

20%

Detectionresponse

Controltuning, SOC handoff, workflows and AI-assisted capability evaluation.

15%

Operations

Documentation,communication, incident and change follow-through.