Security Engineer

Role:
Staff Security Engineer I

Location:

Dallas, TX highly preferred but US Remote will be considered

Overview:

The Cyber Defense Engineering team at Blue Yonder owns the security tooling that protects the organization's multi-cloud estate across nine business units. As the platform engineering team behind the SOC, we implement, administer, and continuously evolve the technologies that enable effective detection, response, and protection across our enterprise security ecosystem.

We are seeking a Staff Security Engineer I to serve as a key contributor across endpoint security, security platforms, cloud security, and automation initiatives. This hands‑on engineering role will have primary ownership of our Crowd Strike Falcon platform while supporting critical technologies across our cyber defense stack. You will be responsible for maintaining platform health, onboarding and operationalizing new security tools, driving automation through scripting and APIs, troubleshooting complex technical issues, and continuously improving the experience and effectiveness of our analysts and security operations teams.

What You’ll Do:

• Own the Crowd Strike Falcon stack end to end. Administer the full platform, EDR/NGAV, Identity Protection, Exposure Management, Cloud Security, NGSIEM (Log Scale), Fusion SOAR, and Counter Adversary Operations - under our Falcon Complete license. Manage sensor health, policies, exclusions, and the sensor update lifecycle across a multi-cloud fleet (VMware, Azure, AWS, GCP, OCI).
• Implement new tools within the cyber defense scope. Lead the deployment, integration, and ongoing administration of new security platforms as the team adopts them, from proof-of-concept through to production operating model, documentation, and handover.
• Engineer and maintain data flows. Build and maintain log ingestion pipelines into NGSIEM, onboard new sources across cloud and on-prem, and keep parsing, normalization, and connectors reliable. Investigate and resolve ingestion gaps, duplication, and attribution issues.
• Keep the platform running. Own platform health, patching/upgrades, configuration governance, and capacity. Diagnose and resolve issues quickly, and drive complex problems to root cause, including working escalations with vendor TAMs and support.
• Automate and orchestrate. Use Fusion SOAR (and adjacent automation) to eliminate manual toil, enforce lifecycle policies, and streamline provisioning and response workflows.
• Bring AI into the workflow. Actively adopt AI‑driven capabilities to raise the team’s speed and quality - leverage platform‑native AI (e.g., Crowd Strike Charlotte AI) for triage, investigation, and querying, and apply AI assistants and agentic tooling to accelerate scripting, documentation, and operational analysis. Help the team evaluate where AI genuinely improves detection engineering and administration versus where it doesn’t.
• Ease the life of analysts. Partner closely with the SOC to tune detections, reduce noise, standardize workflows, and remove operational friction. Translate analyst pain points into platform improvements.
• Govern access and configuration. Manage role‑based access, user and API lifecycle, and least‑privilege enforcement across the security toolset.
• Document and communicate. Produce clear operational runbooks, process documents, and design write‑ups, and communicate effectively with both technical peers and leadership stakeholders.

What We're Looking For:

Required:

• 6+ years in security engineering, security administration, or a closely related infrastructure/operations role.
• Hands‑on administration experience with Crowd Strike Falcon (or a comparable enterprise EDR/XDR platform), sensor management, policy configuration, and troubleshooting at scale.
• Working…