Key Responsibilities
CrowdStrike Falcon Complete: Primary technical responder for CrowdStrike escalations, triage, process tree analysis, host timelines, and MSSP quality evaluation.
Incident Response & Hunting: Lead low/mod-severity incident investigations, map hunt hypotheses to MITRE ATT&CK, and support major incidents across endpoint, identity, cloud, and network telemetry.
Detection & Automation: Identify detection gaps, tune noisy alerts, and build/test Falcon Fusion SOAR automation workflows.
Platform Health & Metrics: Monitor sensor health, validate logging/ingestion in Falcon Next-Gen SIEM, maintain SOPs/playbooks, and mentor junior analysts.
On-Call: Participate in the SOC on-call rotation.
Requirements & Qualifications
Experience: 5+ years in Security Operations / Incident Response.
Must-Have Tool: Hands-on experience with CrowdStrike Falcon console (investigating detections/escalations).
Certifications: CrowdStrike Certified Falcon Responder (CCFR) active or within 60 days of hire. (Nice-to-have: CCFH, CCFA, CCSA, GCIH, GCFA, Security+, CySA+).
Core Skills: Windows/Linux internals, Active Directory / Entra ID attack vectors, MITRE ATT&CK, Python/PowerShell scripting (preferred).

Security Operations Center Analyst

Similar Analytics Jobs