Security Operations Analyst I – GovCloud Incident Response

CrowdStrike; United States; On-site; USD 85,000 - 120,000; Full time

Benefits offered by this job

Equity awards

Wellness programs

Vacation & holidays

Parental leave

Professional development

Employee networks

Office culture & amenities

Great Place to Work

Job summary

CrowdStrike, a global leader in cybersecurity, seeks a technical analyst to join its security operations center. You will triage, investigate, and respond to detections across endpoints, identity, email, network, and cloud environments, and perform malware analysis to support incident triage.

Ideal candidates bring hands-on incident handling, forensic skills, and experience with SIEM and EDR tools, plus strong communication with customers during incidents.

Qualifications

• Experience in incident handling across security events and response coordination.
• Familiarity with MITRE ATT&CK frameworks in active investigations.
• Hands-on use of forensic analysis tools in investigations.
• Basic static/dynamic malware analysis abilities.

Responsibilities

• Triage, investigate, and respond to detections across endpoints, identity, email, network, and cloud.
• Analyze EDR telemetry, logs, and artifacts to determine root cause and remediation scope.
• Investigate Microsoft 365 activity including BEC and AITM attacks; contain threats.
• Perform basic malware analysis to support incident triage.
• Develop and improve incident detection and countermeasure processes.
• Deliver clear customer communications as primary incident contact.
• Produce high-quality written and verbal reports to customers and internal teams.

Skills

Incident Handling

Threat Landscape Awareness

Forensic Analysis

Malware Analysis

OS Fundamentals

Network Analysis

Identity Platform Awareness

Email Security Awareness

Scripting

SIEM

Education

BA/BS or MA/MS in CS/Engineering/InfoSec or related

Tools

Okta

Microsoft Entra ID

Active Directory

SIEM platforms

Forensic tools

EDR tools

Job description

CrowdStrike, a global leader in cybersecurity, seeks a technical analyst to join its security operations center. You will triage, investigate, and respond to detections across endpoints, identity, email, network, and cloud environments, and perform malware analysis to support incident triage.

Ideal candidates bring hands-on incident handling, forensic skills, and experience with SIEM and EDR tools, plus strong communication with customers during incidents.