Senior Incident Response Lead — Endpoint Security

CrowdStrike Inc.; Topeka (KS); Remote; USD 125,000 - 180,000; Full time

Job summary

CrowdStrike is seeking a Senior Analyst for the Endpoint Protection Team to lead complex investigations across endpoint, identity, email, network, and cloud environments. You will analyze EDR telemetry and forensic data to determine root cause, attacker TTPs, and full scope of compromise for high-severity incidents.

You will guide remediation, mentor teammates, and contribute to training materials while collaborating with customers to implement robust security controls and leveraging AI-enhanced

Qualifications

• Extensive incident response leadership experience and ability to own high-severity investigations from triage to remediation.
• Deep knowledge of attack techniques and ability to apply MITRE ATT&CK to detection and investigation.
• Proven forensic analysis across host, memory and network artifacts.

Responsibilities

• Lead complex investigations across endpoint, identity, email, network and cloud environments for high-severity incidents.
• Analyze telemetry and network data to determine root cause and scope of compromise.
• Provide expert guidance on Microsoft 365 security incidents such as BEC and AITM to customers.
• Develop remediation plans and coordinate containment with third parties.
• Mentor analysts and contribute to training materials and knowledge bases.

Skills

Incident Handling

Threat Landscape Awareness

Computer Forensic Analysis

Malware Analysis

Operating System Fundamentals

Systems Administration

Network Analysis Fundamentals

Identity Platform Awareness

Email Security Awareness

Third-Party Log Analysis

Incident Remediation

Network Operations and Architecture/工程

Programming/Scripting

AI Platforms

Education

BA/BS in Computer Science, Information Security, or related field

Tools

Okta

Microsoft Entra ID

Active Directory

Python

PowerShell

Bash

Job description

CrowdStrike is seeking a Senior Analyst for the Endpoint Protection Team to lead complex investigations across endpoint, identity, email, network, and cloud environments. You will analyze EDR telemetry and forensic data to determine root cause, attacker TTPs, and full scope of compromise for high-severity incidents.

You will guide remediation, mentor teammates, and contribute to training materials while collaborating with customers to implement robust security controls and leveraging AI-enhanced