Sr. Engineer (CrowdStrike Falcon)

Position: Senior Engineer 

Role purpose

Build, deploy and improve CrowdStrike Falcon platform
capabilities across endpoint and cloud environments. The role combines Falcon
platform engineering with secure cloud-native development, integration and
automation, while partnering with the SOC and cloud teams to improve detection
and response outcomes.

Key Responsibilities:

·        Build, configure and maintain Falcon components
including sensor deployment and health, host groups, prevention and response
policies, exclusions, access controls and update rings appropriate to deployed
licences.

·        Engineer reliable Falcon coverage for GCP
compute and Kubernetes workloads, partnering on cloud account integration,
sensor or operator deployment, admission controls and image analysis where in
scope.

·        Create and maintain Terraform modules and
deployment pipelines for supported Falcon resources, cloud integration and
Kubernetes components.

·        Build Python automation and, where required,
Java services or integrations using Falcon APIs, SDKs, event streams and
approved enterprise interfaces.

·        Integrate Falcon detections, incidents, asset
and response data into Google SecOps, ServiceNow and other approved workflows;
validate mapping, event quality, latency and case traceability.

·        Design and tune detection and response policies,
indicators and orchestration workflows with SOC analysts; measure coverage,
noise, speed and operational impact.

·        Evaluate AI-assisted triage and response
capabilities with human review, approvals, auditability, test cases and
false-positive safeguards before production use.

·        Investigate platform health, sensor coverage
gaps, policy conflicts and failed integrations; maintain runbooks, test
evidence, change records and knowledge transfer.

Mandatory skills and experience:

·        Hands-on production engineering of CrowdStrike
Falcon, including deployment, policy configuration, sensor lifecycle, host
grouping, exclusions, RBAC and troubleshooting.

·        Practical experience using Falcon APIs and
Python for automation, workflow integration and event processing, including
authentication, scopes, retries and failure handling.

·        Terraform experience for repeatable platform and
cloud configuration, with modules, state, pipelines, testing and drift
management.

·        GCP knowledge covering organisations, projects,
IAM, service accounts, compute, networking and secure workload integration.

·        Kubernetes and container security knowledge
covering clusters, namespaces, images, admission controls, runtime
instrumentation and controlled rollouts.

·        Experience building or maintaining cloud-native
integrations in Python and Java, including APIs, testing, observability and
secure deployment.

·        Understanding of endpoint and cloud threat
detection, policy tuning, incident response and SOC handoff.

Desirable skills and experience:

·        Experience with Falcon Cloud Security, Fusion
SOAR, Foundry or Charlotte AI capabilities where deployed and licensed.

·        CrowdStrike Terraform provider and Kubernetes
deployment module experience.

·        Google SecOps, ServiceNow, vulnerability
tooling, CI or CD and enterprise identity integration experience.

·        Production Java development depth, especially
event-driven or containerised services.

·        Experience in regulated financial services and
platform continuity.

Expected deliverables:

·        Documented Falcon platform baseline, component
inventory, policy map, integration map, sensor coverage and known gaps.

·        Tested Terraform modules and pipelines for
repeatable configuration, GCP onboarding and Kubernetes coverage.

·        Production-ready Python or Java integrations
with controls, tests, logs, monitoring, runbooks and ownership.

·        Validated detection and response improvements,
including AI-assisted workflow assessment with defined human control points.

·        Coverage and health reporting, integration test
results, change records and a prioritised improvement backlog.