Senior Identity Protection Specialist

Protect identities at global scale. We’re hiring a hands-on Senior Identity Protection Engineer/Specialist to lead detection, investigation, and response for identity-based threats across Microsoft Entra /Azure AD, on ‑ prem Active Directory, and connected SaaS/IaaS. You’ll serve as the enterprise SME/administrator for Crowd Strike Identity Protection, tune high-fidelity detections, integrate dark web intelligence, and orchestrate automation that measurably reduces MTTD/MTTR and risk.

What you’ll doLead identity threat monitoring and triage

Operate and tune Crowd Strike Identity Protection; monitor SIEM/UEBA and identity telemetry for risks like impossible travel, atypical sign ‑ ins, MFA fatigue, and session hijacking

Validate true/false positives, prioritize by business impact, and escalate per playbooks/SLAsDrive rapid containment and remediation

Execute containment actions (disable accounts, revoke sessions/tokens, isolate hosts)
Coordinate remediation with IAM/Endpoint/Infrastructure; verify risk reduction to closure

Own identity-focused incident response

Lead IR for credential compromise, privilege escalation, directory persistence, and lateral movement

Ensure evidence handling, root cause analysis, post ‑ incident reviews, and lessons learned

Engineer detections and hunt for threats

Build and refine detections and hunts across SIEM/EDR/identity platforms using KQL/SQL/regex/Sigma aligned to MITRE ATT&CKClose visibility gaps, reduce false positives, and expand privileged activity monitoring

Strengthen privileged access controls

Detect anomalous privileged behavior via SIEM/UEBA and Netskope telemetry

Recommend/enforce JIT, break ‑ glass patterns, and mover/leaver privilege hygiene with IAMRespond to dark web/credential exposure

Integrate sources like Cyber Int; assess exposure and targeted campaigns

Orchestrate takedowns, forced resets, token revocation, and Conditional Access updates

Administer platforms and sustain hygiene

Maintain coverage/health for identity monitoring; manage upgrades and changes via CABKeep operational runbooks, SOPs, and playbooks current

Automate and orchestrate at scale

Use Power Shell/Python and REST/Graph/Crowd Strike APIs (and SOAR where applicable) to automate enrichment and response, standardize workflows, and improve signal fidelity

Shape identity policy and controls

Advise on Conditional Access, MFA exceptions, SSO/SCIM patterns, and session controls under the shared ‑ responsibility model with IAMReport outcomes and support audits

Produce executive-ready dashboards and KPIs (identity incident volume, MTTD/MTTR, CA/MFA efficacy, exposure/takedown cycle time)
Maintain audit-ready evidence and support internal/external audits

What you’ll bring

Bachelor’s degree in Cybersecurity, Computer Science, IT, or related field; or equivalent practical experience8+ years in IT/cybersecurity, including 3+ years focused on identity security/operations (Entra /Azure AD, on ‑ prem AD, MFA, Conditional Access, SSO/SCIM)
Hands-on enterprise experience administering/operating Crowd Strike Identity Protection Proficiency with SIEM/UEBA (Splunk preferred) and cloud security platforms (e.g., Netskope) for identity telemetry, detection, and investigations

Demonstrated experience in identity ‑ centric IR, threat hunting, and detection engineering (KQL/SQL/regex/Sigma)
Scripting/automation with Power Shell and Python; experience with REST/Graph/Crowd Strike APIs and SOARClear communication and documentation skills; comfortable producing executive ‑ ready reports and audit evidence

Operates effectively within change control/CAB and under pressure during high ‑ severity incidents

Bonus points

Certifications:

Microsoft SC ‑ 200/SC ‑ 300;
Okta Certified Administrator/Professional; CISSP, SSCP, Security+; GIAC (GMON, GCIH, GCDA) or equivalent

Deep knowledge of identity attack paths and protocols (Kerberos/NTLM), token/session abuse, and persistence techniques (e.g., Golden/Silver Ticket, DCShadow)

Experience with JIT/JEA, PAM concepts, and global on ‑ call rotations

Location, work style, and travel

Opportunities in the United States, United Kingdom, and Denmark Onsite or hybrid depending on location and business…