Senior Tier 3 CrowdStrike Architect

Senior Tier 3 CrowdStrike Architect

Location: Des Moines, IA – Remote

Employment Type: Full-Time, W2

Work Authorization: US Citizen / Green Card Only

Interview: Webcam or In-Person

Job Description

We are seeking a Senior Tier 3 CrowdStrike Architect with strong enterprise cybersecurity experience to architect, manage, and optimize the CrowdStrike Falcon platform across 10,000+ endpoints and multiple agency environments.

The ideal candidate will be responsible for Falcon architecture, CID hierarchy, RBAC, security policies, sensor management, IOA/IOC development, platform health, and advanced Tier 3 incident response. This role requires hands-on expertise with Real-Time Response (RTR), threat hunting, endpoint forensics, and complex security investigations.

The candidate will also support SIEM/SOAR integrations, CrowdStrike APIs, Fusion workflows, automation, dashboards, and automated remediation. Strong knowledge of Windows, Linux, macOS, PowerShell, Python, and Bash is required.

Additional expertise in Active Directory/Entra ID, network security, vulnerability management, patch management, and MITRE ATT&CK is important. The successful candidate will develop security standards and SOPs, provide technical mentoring, and work directly with CrowdStrike engineering and TAM teams.

Key Requirements

• 4+ years of hands-on CrowdStrike Falcon experience
• Enterprise-scale experience managing 10,000+ endpoints
• Strong Tier 3 incident response and threat hunting experience
• Expertise with RTR, IOA/IOC, Falcon policies, RBAC, and sensor management
• Experience with Windows, Linux, and macOS
• Strong PowerShell, Python, and/or Bash scripting skills
• Experience with SIEM/SOAR, APIs, Fusion, and security automation
• Knowledge of AD/Entra ID, network security, vulnerability management, and MITRE ATT&CK
• Strong communication and technical documentation skills
• Experience working in large enterprise or multi-tenant environments preferred
• 
  

Certification

At least one active CrowdStrike certification required:

• CCFA – CrowdStrike Certified Falcon Administrator
• CCFR – CrowdStrike Certified Falcon Responder
• CCFH – CrowdStrike Certified Falcon Hunter

Additional certifications such as CISSP, GCFA, GCIH, GSEC, or CISA are preferred.

Preferred Experience

• State/local government or higher education environments
• Large multi-tenant enterprise security environments
• NIST SP 800-53, CJIS, HIPAA, or IRS Publication 1075
• CrowdStrike integration with platforms such as Splunk, Microsoft Sentinel, or Palo Alto Cortex