Senior Security Incident Lead – Endpoint & IR (Remote)

CrowdStrike Inc.; Cheyenne (WY); Remote; USD 125,000 - 180,000; Full time

Benefits offered by this job

Market-leading compensation

Wellness programs

Competitive vacation and holidays

Parental and adoption leaves

Professional development

Employee networks and community

Vibrant office culture

Great Place to Work Certification

Job summary

CrowdStrike is seeking a Senior Analyst to lead high-severity investigations across endpoints, identity, email, network, and cloud. You will analyze EDR telemetry and forensic data, determine root cause and attacker TTPs, and guide remediation for complex incidents with cross-team collaboration.

You will mentor junior staff, drive improvements, and contribute to SOPs while engaging in thought leadership and external speaking. Remote work options available in the US.

Qualifications

• Lead complex incident response investigations from triage through remediation.
• Apply MITRE ATT&CK to drive detection improvements and investigation strategies.
• Conduct forensic analysis across host, memory, and network artifacts.
• Perform malware analysis including static/dynamic analysis and behavior.
• Provide expert guidance for Microsoft 365 security incidents and BEC/AITM.
• Develop scripts/automation to build investigative tooling.
• Mentor peers and contribute to team development.
• Drive process improvements and SOP development.
• Represent CrowdStrike in thought leadership and external engagements.
• Deliver clear, expert customer communications during escalations.

Responsibilities

• Lead complex investigations across endpoint, identity, email, network, and cloud environments.
• Conduct advanced analysis of telemetry and artifacts to determine root cause and scope.
• Investigate Microsoft 365 attacks and provide expert guidance to customers.
• Review malware analysis to inform detection and remediation strategies.
• Develop remediation plans coordinating third-party containment actions.
• Mentor Analysts and contribute to knowledge base and training materials.
• Identify process improvements and automation opportunities.
• Represent CrowdStrike through blogs, CrowdCasts, and external speaking.
• Deliver expert-level communications to customers during critical incidents.

Skills

Incident Handling

Threat Landscape Awareness

Computer Forensic Analysis

Malware Analysis

Operating System Fundamentals

Systems Administration

Network Analysis Fundamentals

Identity Platform Awareness

Email Security Awareness

Third-Party Log Analysis

Incident Remediation

Programming/Scripting

AI Platforms

Education

BA or BS / MA or MS degree in Computer Science, Computer Engineering, Math, Information Security, Information Assurance, Information Security Management, Intelligence Studies, Cybersecurity, Cybersecurity Policy, or related field

Tools

Okta

Microsoft Entra ID

Active Directory

Job description

CrowdStrike is seeking a Senior Analyst to lead high-severity investigations across endpoints, identity, email, network, and cloud. You will analyze EDR telemetry and forensic data, determine root cause and attacker TTPs, and guide remediation for complex incidents with cross-team collaboration.

You will mentor junior staff, drive improvements, and contribute to SOPs while engaging in thought leadership and external speaking. Remote work options available in the US.