Analyst I, Falcon Complete (Remote, PST/MST)

Overview

Analyst I on the Falcon Complete team at CrowdStrike's virtual security operations center, detecting and responding to security incidents in real time for customers. The role is open to candidates located in either PST or MST timezones.

What you'll do

• Deliver clear, concise, and professional customer communications as the primary first point of contact.
• Produce high-quality written and verbal communications, recommendations, and findings to customers and internally.
• Triage, investigate, and respond to security alerts across endpoint, identity, email, and cloud environments.
• Conduct tactical analysis of EDR telemetry, log sources, and forensic artifacts to identify the scope of compromise and support remediation efforts.
• Investigate suspicious Microsoft 365 activity, including business email compromise (BEC) and adversary-in-the-middle (AITM) attacks, contain the threat, and deliver actionable guidance to customers.
• Develop and improve processes for incident detection and the execution of countermeasures.

What you'll need

• Training or foundational knowledge in incident response processes, including the investigation of security events such as targeted threats, malware infections, and unauthorized access.
• Foundational knowledge of attack vectors, threat actor tactics, techniques, and procedures (TTPs), including familiarity with frameworks such as MITRE ATT&CK.
• Understanding of Windows, Mac, and Linux operating systems, including typical Windows functionality such as the file system, registry, scheduled tasks, and running processes.
• Experience administering a network and troubleshooting issues such as general connectivity and authentication issues, with an understanding of general IT architecture configurations in small to large networks.
• Knowledge of network protocols, network analysis tools, and ability to perform analysis of associated network logs.
• Familiarity with identity and access management platforms such as Okta, Microsoft Entra ID, Active Directory, and similar technologies commonly found in enterprise environments.
• Familiarity with Microsoft 365 security, including common attack patterns such as business email compromise (BEC) and adversary-in-the-middle (AITM) phishing.
• Foundational understanding of log sources across cloud platforms, network devices, identity providers, email platforms, and other enterprise technologies to support investigation and triage within the NG-SIEM service offering.
• Foundational understanding of targeted attacks and the ability to contribute to tactical and strategic remediation efforts for compromised organizations.
• Strong understanding of secure network architecture and a strong background in performing network operations.
• Experience or coursework in scripting languages such as Python, PowerShell, or Bash.
• Experience or demonstrated interest in utilizing AI technologies to enhance decision-making, streamline workflows and processes, improve efficiency and drive business outcomes.
• Proven experience utilizing AI technologies to enhance decision-making, streamline workflows and processes, improve efficiency and drive business outcomes.
• Capable of completing technical tasks without supervision.
• Desire to grow and expand both technical and soft skills.
• Strong troubleshooting skills with a passion for solving complex technical problems.
• Ability to foster a positive work environment and attitude.
• Education: BA or BS / MA or MS degree in Computer Science, Computer Engineering, Math, Information Security, Information Assurance, Information Security Management, Intelligence Studies, Cybersecurity, Cybersecurity Policy, or a related field. Applicants without a degree but with relevant work experience and/or training will be considered.

Details

• Location: USA, remote. Open to candidates located in PST or MST timezones.
• Must be willing to work a 4x10 schedule, including a day on the weekend.
• Must be willing to work on site (hybrid schedule).
• Role may require periodic alcohol and/or drug testing during employment.