In this role, you will support day-to-day security operations, investigate endpoint and identity-related security issues, and help administer and improve the CrowdStrike Falcon platform. You will also contribute to the automation of security workflows using Fusion SOAR, scripting, APIs, and AI-assisted capabilities.

This position is suitable for an early-career security professional who enjoys hands-on troubleshooting, security investigation, platform administration, and continuous improvement.

Job Description

Handle day-to-day security alerts, incidents, operational issues, and service requests in accordance with established procedures and service levels.
Investigate endpoint and identity-related security issues using CrowdStrike telemetry, Active Directory information, authentication records, and system logs.
Support containment and remediation activities, including host isolation, account restriction, evidence collection, and coordination with relevant IT teams.
Manage security requests such as policy changes, exclusions, allowlisting, investigation requests, and user or device follow-up.
Support the administration of CrowdStrike Falcon capabilities, including Endpoint Security, Identity Protection, Fusion SOAR, Real Time Response, Spotlight, and related integrations.
Monitor sensor health, platform coverage, policy compliance, workflow status, and operational exceptions.
Support the configuration and maintenance of endpoint, identity, and automation policies based on approved standards.
Develop and maintain Fusion SOAR workflows for alert enrichment, notification, case creation, triage, and response automation.
Troubleshoot CrowdStrike sensor, policy, integration, and Active Directory-related issues with infrastructure, system, and IT support teams.
Maintain operational procedures, investigation guides, response playbooks, workflow documentation, and knowledge articles.
Participate in security operations, platform improvement, and automation initiatives.

Requirements

Bachelor's degree in Computer Engineering, Cybersecurity, Information Security, Computer Science, or a related discipline.
Practical experience in at least one of the following areas:
Security alert investigation or incident handling
EDR or endpoint security platform administration
Active Directory or identity security administration and troubleshooting
Security automation, SOAR, scripting, or API integration
Good platform administration and troubleshooting skills, preferably with CrowdStrike Falcon or a comparable endpoint and identity security platform.
Good understanding of EDR concepts, endpoint telemetry, threat detection, containment, and incident response.
Good knowledge of Microsoft Active Directory, including users, groups, permissions, authentication, Group Policy, and domain controllers.
Hands-on experience with SOAR, workflow automation, Python, PowerShell, scripting, or APIs is preferred.
Experience using AI tools to support security investigation, workflow automation, case summarisation, or knowledge retrieval is an advantage.
CrowdStrike or Microsoft Active Directory and identity-related certifications are an advantage but not mandatory.
Strong analytical, documentation, communication, and cross-team collaboration skills.
Able to manage operational tasks, follow through on investigations, and coordinate remediation within agreed timelines.

Security Analyst

Security Operations Analyst