Sr. Engineer (CrowdStrike Falcon)

XPT Software Australia; Melbourne; On-site; AUD 120,000 - 180,000; Full time

Job summary

XPT Software Australia is seeking a Senior Engineer to build, deploy and improve CrowdStrike Falcon platform capabilities across on-premise and cloud environments. The role blends Falcon platform engineering with secure cloud-native development, automation and SOC collaboration to enhance detection and response outcomes.

The successful candidate will own Falcon components, policy tuning and cloud integrations, partnering with SOC, cloud and Kubernetes teams to deliver scalable, secure

Qualifications

• Hands-on production engineering of CrowdStrike Falcon
• Practical experience using Falcon APIs and Python for automation
• Terraform experience for repeatable platform and cloud configuration
• GCP knowledge covering IAM, compute, networking and secure workload integration
• Kubernetes and container security knowledge incl. admission controls and runtime instrumentation
• Experience building cloud-native integrations in Python and Java
• Understanding of endpoint and cloud threat detection, incident response and SOC handoff

Responsibilities

• Build, configure and maintain Falcon components including sensor deployment and health
• Engineer reliable Falcon coverage for GCP compute and Kubernetes workloads
• Create and maintain Terraform modules and deployment pipelines
• Build Python automation and Java services or integrations
• Integrate Falcon data into SecOps and ServiceNow workflows
• Design and tune detection and response policies with SOC analysts
• Evaluate AI-assisted triage and response capabilities
• Investigate platform health and maintain runbooks and change records

Skills

Falcon deployment

Python automation

Terraform

GCP

Kubernetes security

RBAC

Java services

Tools

CrowdStrike Falcon API

Python

Java

Job description

Role purpose

Build, deploy and improve CrowdStrike Falcon platform capabilities across endpoint and cloud environments. The role combines Falcon platform engineering with secure cloud-native development, integration and automation, while partnering with the SOC and cloud teams to improve detection and response outcomes.

Position: Senior Engineer

Suggested level

Senior Engineer or experienced Engineer with demonstrable production ownership

Primary Accountability

Falcon platform components, sensor coverage, policies, integrations, cloud workload protection, automation and platform health.

Key interfaces

Cyber Platforms TPO, SOC, cloud and Kubernetes teams, endpoint services, ServiceNow, identity, network and application teams.

Key Responsibilities

• Build, configure and maintain Falcon components including sensor deployment and health, host groups, prevention and response policies, exclusions, access controls and update rings appropriate to deployed licences.
• Engineer reliable Falcon coverage for GCP compute and Kubernetes workloads, partnering on cloud account integration, sensor or operator deployment, admission controls and image analysis where in scope.
• Create and maintain Terraform modules and deployment pipelines for supported Falcon resources, cloud integration and Kubernetes components.
• Build Python automation and, where required, Java services or integrations using Falcon APIs, SDKs, event streams and approved enterprise interfaces.
• Integrate Falcon detections, incidents, asset and response data into Google SecOps, ServiceNow and other approved workflows; validate mapping, event quality, latency and case traceability.
• Design and tune detection and response policies, indicators and orchestration workflows with SOC analysts; measure coverage, noise, speed and operational impact.
• Evaluate AI-assisted triage and response capabilities with human review, approvals, auditability, test cases and false-positive safeguards before production use.
• Investigate platform health, sensor coverage gaps, policy conflicts and failed integrations; maintain runbooks, test evidence, change records and knowledge transfer.

Mandatory Skills And Experience

• Hands-on production engineering of CrowdStrike Falcon, including deployment, policy configuration, sensor lifecycle, host grouping, exclusions, RBAC and troubleshooting.
• Practical experience using Falcon APIs and Python for automation, workflow integration and event processing, including authentication, scopes, retries and failure handling.
• Terraform experience for repeatable platform and cloud configuration, with modules, state, pipelines, testing and drift management.
• GCP knowledge covering organisations, projects, IAM, service accounts, compute, networking and secure workload integration.
• Kubernetes and container security knowledge covering clusters, namespaces, images, admission controls, runtime instrumentation and controlled rollouts.
• Experience building or maintaining cloud-native integrations in Python and Java, including APIs, testing, observability and secure deployment.
• Understanding of endpoint and cloud threat detection, policy tuning, incident response and SOC handoff.

Desirable Skills And Experience

• Experience with Falcon Cloud Security, Fusion SOAR, Foundry or Charlotte AI capabilities where deployed and licensed.
• CrowdStrike Terraform provider and Kubernetes deployment module experience.
• Google SecOps, ServiceNow, vulnerability tooling, CI or CD and enterprise identity integration experience.
• Production Java development depth, especially event-driven or containerised services.
• Experience in regulated financial services and platform continuity.

Expected Deliverables

• Documented Falcon platform baseline, component inventory, policy map, integration map, sensor coverage and known gaps.
• Tested Terraform modules and pipelines for repeatable configuration, GCP onboarding and Kubernetes coverage.
• Production-ready Python or Java integrations with controls, tests, logs, monitoring, runbooks and ownership.
• Validated detection and response improvements, including AI-assisted workflow assessment with defined human control points.
• Coverage and health reporting, integration test results, change records and a prioritised improvement backlog.

Assessment area

Evidence expected

Weight

Falcon engineering

Sensor, policy, platform health and API work, including contribution and scale.

30%

Cloud and IaC

GCP, Kubernetes and Terraform deployments, testing and release controls.

25%

Software integration

Python and Java examples, API design, secure coding and operational support.

20%

Detection response

Control tuning, SOC handoff, workflows and AI-assisted capability evaluation.

15%

Operations

Documentation, communication, incident and change follow-through.

10%