Analyst I, Falcon Complete (Remote, PST/MST)

Overview

Analyst I on the Falcon Complete team within CrowdStrike's virtual security operations center, detecting and responding to security incidents in real time for customers. This role is open to candidates located in either PST or MST timezones.

What you'll do

• Deliver clear, concise, and professional customer communications as the primary first point of contact.
• Produce high-quality written and verbal communications, recommendations, and findings to customers and internally.
• Triage, investigate, and respond to security alerts across endpoint, identity, email, and cloud environments.
• Conduct tactical analysis of EDR telemetry, log sources, and forensic artifacts to identify the scope of compromise and support remediation efforts.
• Investigate suspicious Microsoft 365 activity, including business email compromise (BEC) and adversary-in-the-middle (AITM) attacks, contain the threat, and deliver actionable guidance to customers.
• Develop and improve processes for incident detection and the execution of countermeasures.

What you'll need

• Training or knowledge in incident handling: incident response processes, including investigation of targeted threats, malware infections, and unauthorized access.
• Foundational knowledge of threat landscape, attack vectors, and threat actor TTPs, including familiarity with frameworks such as MITRE ATT&CK.
• Understanding of Windows, Mac, and Linux operating systems, including the file system, registry, scheduled tasks, and running processes.
• Experience administering a network and troubleshooting general connectivity and authentication issues; understanding of general IT architecture configurations in small to large networks.
• Knowledge of network protocols, network analysis tools, and ability to analyze associated network logs.
• Familiarity with identity and access management platforms such as Okta, Microsoft Entra ID, Active Directory, and similar technologies.
• Familiarity with Microsoft 365 security, including common attack patterns such as business email compromise (BEC) and adversary-in-the-middle (AITM) phishing.
• Foundational understanding of log sources across cloud platforms, network devices, identity providers, email platforms, and other enterprise technologies to support investigation and triage.
• Foundational understanding of targeted attacks and the ability to contribute to tactical and strategic remediation efforts for compromised organizations.
• Strong understanding of secure network architecture and a strong background in performing network operations.
• Experience or coursework in scripting languages such as Python, PowerShell, or Bash.
• Experience or demonstrated interest in utilizing AI technologies to enhance decision-making, streamline workflows and processes, improve efficiency and drive business outcomes; proven experience utilizing AI technologies for these purposes.
• Capable of completing technical tasks without supervision.
• Desire to grow and expand both technical and soft skills.
• Strong troubleshooting skills with a passion for solving complex technical problems.
• Ability to foster a positive work environment and attitude.
• BA or BS / MA or MS degree in Computer Science, Computer Engineering, Math, Information Security, Information Assurance, Information Security Management, Intelligence Studies, Cybersecurity, Cybersecurity Policy, or a related field, or applicable work experience and/or training.

Details

• Remote, USA; open to candidates located in PST or MST timezones.
• Must be willing to work a 4x10 schedule, including a day on the weekend.
• May periodically be required to undergo and pass alcohol and/or drug tests during employment.