Senior Endpoint Security and Incident Response Specialist (CrowdStrike/SecureWorks SME)

Endpoint Security / Incident Response Specialist

Location: Fully Remote (U.S.) Must be in PST

Overview

We are seeking a highly experienced Endpoint Security and Incident Response Specialist to support enterprise-level cybersecurity operations. This role will serve as a subject matter expert (SME) in CrowdStrike Falcon and SecureWorks platforms, leading incident response efforts, endpoint protection strategies, and advanced threat detection across a complex environment.

Key Responsibilities

• Lead and execute incident response activities in a large enterprise environment, including investigation, containment, and remediation of security events
• Serve as SME for CrowdStrike Falcon, managing platform configuration, optimization, and ongoing administration across multiple environments
• Configure and maintain telemetry API integrations across SIEM, XDR, and endpoint security tools
• Administer Endpoint Detection & Response (EDR) platforms, including:
• Prevention policies

Interested in remote work opportunities in Cyber Security? Discover Cyber Security Remote Jobs featuring exclusive positions from top companies that offer flexible work arrangements.

• IOA exclusions
• USB device control
• Firewall configurations
• Fusion SOAR workflow automation
• Perform advanced threat hunting using endpoint and data protection tools to proactively identify risks
• Analyze malware, utilize threat intelligence feeds, and conduct sandbox analysis to support detection and response efforts
• Develop automation using scripting languages (PowerShell, Python, Bash) to enhance security operations and response times
• Integrate and manage APIs for reporting, automation, and tool interoperability
• Generate and deliver security reports using APIs and platform-native reporting tools
• Collaborate with cross-functional teams to ensure effective monitoring, detection, and response across the enterprise

Required Qualifications

• 3+ years (within last 4 years): Enterprise incident response experience
• 3+ years (within last 4 years): Telemetry API integrations with SIEM/XDR tools
• 6+ years (within last 8 years):
• Managing CrowdStrike Falcon and SecureWorks platforms
• Administering EDR tools (policies, IOAs, device control, SOAR workflows)
• Malware analysis, threat intelligence, and sandboxing
• 5+ years: Experience with virtualization/VDI and cloud SaaS environments
• 4+ years: Scripting/programming with PowerShell, Python, or Bash
• 2+ years: API integration and automation experience
• Bachelor’s degree or equivalent experience