Sr. Engineer (CrowdStrike Falcon)

XPT Software; Melbourne; On-site; AUD 110,000 - 170,000; Full time

Job summary

XPT Software in Melbourne is seeking a Senior Engineer to build, deploy and improve CrowdStrike Falcon platform capabilities across on‑premise and cloud environments. You will own Falcon components, sensor health, policies and integrations while partnering with SOC and cloud teams.

This role emphasizes cloud‑native development, automation with Terraform and Python, and robust security controls for GCP and Kubernetes workloads.

Qualifications

• Hands-on production engineering of CrowdStrike Falcon, including deployment, policy configuration, sensor lifecycle, host grouping, exclusions, RBAC and troubleshooting.
• Practical experience using Falcon APIs and Python for automation, workflow integration and event processing.
• Terraform for repeatable platform and cloud configuration, modules, state, pipelines and drift management.
• GCP knowledge covering organisations, projects, IAM, service accounts, compute and secure workload integration.
• Kubernetes and container security knowledge including clusters, namespaces, images, admission controls and controlled rollouts.
• Experience building or maintaining cloud-native integrations in Python and Java, including APIs and observability.
• Understanding of endpoint and cloud threat detection, policy tuning and SOC handoff.

Responsibilities

• Build, configure and maintain Falcon components including sensor deployment and health, host groups, policies, exclusions, access controls and update rings.
• Engineer reliable Falcon coverage for GCP compute and Kubernetes workloads, partnering on cloud account integration and sensor deployment.
• Create and maintain Terraform modules and deployment pipelines for Falcon resources, cloud integration and Kubernetes components.
• Build Python automation and, where required, Java services or integrations using Falcon APIs and SDKs.
• Integrate Falcon data into Google SecOps, ServiceNow and other workflows; validate mapping and event quality.
• Design and tune detection and response policies, indicators and orchestration workflows with SOC analysts.
• Evaluate AI-assisted triage and response capabilities with human review and auditability.
• Investigate platform health, sensor coverage gaps and ensure runbooks and change records are maintained.

Skills

Falcon platform engineering

Falcon API automation

Terraform automation

GCP IAM & compute

Kubernetes security

Cloud-native integration (Python/Java)

Endpoint/cloud threat detection

Job description

Build, deploy and improve CrowdStrike Falcon platform capabilities across endpoint and cloud environments. The role combines Falcon platform engineering with secure cloud-native development, integration and automation, while partnering with the SOC and cloud teams to improve detection and response outcomes.

Suggested level

Senior Engineer or experienced Engineer with demonstrable production ownership

Primary accountability

Falcon platform components, sensor coverage, policies, integrations, cloud workload protection, automation and platform health.

Key interfaces

Cyber Platforms TPO, SOC, cloud and Kubernetes teams, endpoint services, ServiceNow, identity, network and application teams.

Key Responsibilities:

• Build, configure and maintain Falcon components including sensor deployment and health, host groups, prevention and response policies, exclusions, access controls and update rings appropriate to deployed licences.
• Engineer reliable Falcon coverage for GCP compute and Kubernetes workloads, partnering on cloud account integration, sensor or operator deployment, admission controls and image analysis where in scope.
• Create and maintain Terraform modules and deployment pipelines for supported Falcon resources, cloud integration and Kubernetes components.
• Build Python automation and, where required, Java services or integrations using Falcon APIs, SDKs, event streams and approved enterprise interfaces.
• Integrate Falcon detections, incidents, asset and response data into Google SecOps, ServiceNow and other approved workflows; validate mapping, event quality, latency and case traceability.
• Design and tune detection and response policies, indicators and orchestration workflows with SOC analysts; measure coverage, noise, speed and operational impact.
• Evaluate AI-assisted triage and response capabilities with human review, approvals, auditability, test cases and false-positive safeguards before production use.
• Investigate platform health, sensor coverage gaps, policy conflicts and failed integrations; maintain runbooks, test evidence, change records and knowledge transfer.

Mandatory skills and experience:

• Hands-on production engineering of CrowdStrike Falcon, including deployment, policy configuration, sensor lifecycle, host grouping, exclusions, RBAC and troubleshooting.
• Practical experience using Falcon APIs and Python for automation, workflow integration and event processing, including authentication, scopes, retries and failure handling.
• Terraform experience for repeatable platform and cloud configuration, with modules, state, pipelines, testing and drift management.
• GCP knowledge covering organisations, projects, IAM, service accounts, compute, networking and secure workload integration.
• Kubernetes and container security knowledge covering clusters, namespaces, images, admission controls, runtime instrumentation and controlled rollouts.
• Experience building or maintaining cloud-native integrations in Python and Java, including APIs, testing, observability and secure deployment.
• Understanding of endpoint and cloud threat detection, policy tuning, incident response and SOC handoff.

Desirable skills and experience:

• Experience with Falcon Cloud Security, Fusion SOAR, Foundry or Charlotte AI capabilities where deployed and licensed.
• CrowdStrike Terraform provider and Kubernetes deployment module experience.
• Google SecOps, ServiceNow, vulnerability tooling, CI or CD and enterprise identity integration experience.
• Production Java development depth, especially event-driven or containerised services.
• Experience in regulated financial services and platform continuity.
• Documented Falcon platform baseline, component inventory, policy map, integration map, sensor coverage and known gaps.
• Tested Terraform modules and pipelines for repeatable configuration, GCP onboarding and Kubernetes coverage.
• Production-ready Python or Java integrations with controls, tests, logs, monitoring, runbooks and ownership.
• Validated detection and response improvements, including AI-assisted workflow assessment with defined human control points.
• Coverage and health reporting, integration test results, change records and a prioritised improvement backlog.

Assessment area

Evidence expected

Weight

Sensor, policy, platform health and API work, including contribution and scale.

30%

Cloud and IaC

GCP, Kubernetes and Terraform deployments, testing and release controls.

25%

Software integration

Python and Java examples, API design, secure coding and operational support.

20%

Detection response

Control tuning, SOC handoff, workflows and AI-assisted capability evaluation.

15%

Operations

Documentation, communication, incident and change follow-through.