Sr Security Administrator

Blue Yonder; Bengaluru; On-site; INR 1,800,000 - 2,600,000; Full time

Job summary

Blue Yonder in Bengaluru, India, seeks a Senior Security Administrator to own the CrowdStrike Falcon platform end to end. This hands-on role spans sensor health, policy config, and integration of cutting-edge security tools across a multi-cloud estate, enabling analysts to operate securely and efficiently.

You will drive deployment from PoC to production, build scalable log pipelines, automate workflows with Fusion SOAR, and push AI-driven capabilities to improve detection and response while

Qualifications

• 6+ years in security engineering, security administration, or related infra/ops role.
• Hands-on admin with CrowdStrike Falcon - sensor management, policy config, troubleshooting at scale.
• Experience with SIEM/log management concepts and NGSIEM/LogScale or similar.
• Cloud exposure across at least one cloud (Azure, AWS, GCP, OCI) with logging/telemetry knowledge.
• Strong troubleshooting skills and root-cause analysis under pressure.
• Scripting/automation ability (Python/PowerShell) and REST APIs familiarity.
• Fluency with AI tools in daily work and willingness to adopt AI-driven security capabilities.
• Clear written and verbal communication.

Responsibilities

• Own the CrowdStrike Falcon stack end to end, manage sensor health, policies, exclusions, and updates.
• Lead deployment and integration of new security platforms from PoC to production.
• Engineer and maintain data flows; build log ingestion pipelines to NGSIEM/LogScale and ensure data quality.
• Maintain platform health, patching, configuration governance, and capacity planning.
• Automate workflows using Fusion SOAR to reduce manual toil and improve response.
• Apply AI tools to improve detection engineering and analyst efficiency.
• Collaborate with SOC to tune detections and standardize workflows.
• Govern access and API lifecycle with least-privilege enforcement.
• Document runbooks and design write-ups for stakeholders.

Skills

CrowdStrike Falcon

EDR/XDR

SIEM/Log management

Cloud platforms (Azure/AWS/GCP/OCI)

Scripting (Python/PowerShell)

REST APIs

AI tools usage

Communication

Tools

NGSIEM/LogScale

Fusion SOAR

Job description

Senior Security Administrator

Cyber Defense

Team: Cyber Defense

Location: Bengaluru, India

Reports to: Manager, Cyber Defense Engineering

Employment type: Full-time

About the role

The Cyber Defense Engineering team owns the security tooling that protects the organization's multi-cloud estate across nine business units. We are the platform team behind the SOC - we implement, administer, and continuously improve the technologies analysts depend on, so that detection and response run without friction.

We are looking for a Senior Security Administrator to take ownership of our CrowdStrike Falcon platform end to end. This is a hands-on engineering and administration role, not a monitoring or alert-triage role. You will keep the platform healthy, onboard and operationalize new tools that fall within the cyber defense scope, troubleshoot deeply when things break, and make the day-to-day life of our analysts measurably easier.

What you’ll do

• Own the CrowdStrike Falcon stack end to end. Administer the full platform - EDR/NGAV, Identity Protection, Exposure Management, Cloud Security, NGSIEM (LogScale), Fusion SOAR, and Counter Adversary Operations - under our Falcon Complete license. Manage sensor health, policies, exclusions, and the sensor update lifecycle across a multi-cloud fleet (VMware, Azure, AWS, GCP, OCI).
• Implement new tools within the cyber defense scope. Lead the deployment, integration, and ongoing administration of new security platforms as the team adopts them - from proof-of-concept through to production operating model, documentation, and handover.
• Engineer and maintain data flows. Build and maintain log ingestion pipelines into NGSIEM, onboard new sources across cloud and on-prem, and keep parsing, normalization, and connectors reliable. Investigate and resolve ingestion gaps, duplication, and attribution issues.
• Keep the platform running. Own platform health, patching/upgrades, configuration governance, and capacity. Diagnose and resolve issues quickly, and drive complex problems to root cause - including working escalations with vendor TAMs and support.
• Automate and orchestrate. Use Fusion SOAR (and adjacent automation) to eliminate manual toil, enforce lifecycle policies, and streamline provisioning and response workflows.
• Bring AI into the workflow. Actively adopt AI-driven capabilities to raise the team's speed and quality - leverage platform-native AI (e.g., CrowdStrike Charlotte AI) for triage, investigation, and querying, and apply AI assistants and agentic tooling to accelerate scripting, documentation, and operational analysis. Help the team evaluate where AI genuinely improves detection engineering and administration versus where it doesn’t.
• Ease the life of analysts. Partner closely with the SOC to tune detections, reduce noise, standardize workflows, and remove operational friction. Translate analyst pain points into platform improvements.
• Govern access and configuration. Manage role-based access, user and API lifecycle, and least-privilege enforcement across the security toolset.
• Document and communicate. Produce clear operational runbooks, process documents, and design write-ups, and communicate effectively with both technical peers and leadership stakeholders.

What you’ll bring

Required

• 6+ years in security engineering, security administration, or a closely related infrastructure/operations role.
• Hands-on administration experience with CrowdStrike Falcon (or a comparable enterprise EDR/XDR platform) - sensor management, policy configuration, and troubleshooting at scale.
• Working knowledge of SIEM/log management concepts - ingestion, parsing, normalization, and query - ideally with NGSIEM/LogScale or a comparable platform (Splunk, Sentinel, Elastic).
• Practical experience across at least one major cloud (Azure, AWS, GCP, or OCI), including how logging and telemetry are produced and collected.
• Strong troubleshooting instincts and the ability to drive incidents to root cause under pressure.
• Scripting/automation ability (Python, PowerShell, or similar) and comfort working with REST APIs.
• Fluency with AI tools in day-to-day work - using AI assistants for scripting, analysis, and documentation, and a willingness to adopt AI-driven security capabilities as they mature.
• Clear written and verbal communication; able to document processes and work with cross-functional stakeholders.

Preferred

• Experience with SOAR/orchestration platforms (Fusion SOAR or comparable) and building automation workflows.
• Familiarity with identity protection, cloud security posture (CSPM/CNAPP), or exposure/vulnerability management tooling.
• Multi-cloud breadth (two or more of Azure, AWS, GCP, OCI, VMware).
• Experience onboarding and standing up new security tools from POC to production.
• Exposure to email security tooling (e.g., Proofpoint TAP/TRAP) or other cyber defense platforms.
• Deception technology implementation experience - deploying and administering deception/ITD platforms (e.g., Proofpoint Deception) to dete