Analyst , Falcon Complete GovCloud; Hybrid, St Louis

Crowd Strike Technical Analyst, Endpoint Protection Team

Crowd Strike is looking for highly motivated, self-driven technical analysts dedicated to making a difference in global security by protecting organizations against the most advanced attackers in the world. Our Crowd Strike virtual security operations center offers opportunities to expand your skill set through a wide variety of experiences, detecting and responding to incidents as they occur in real-time for our customers.

Am I an Analyst, Endpoint Protection Team Candidate?

• Do you find yourself interested in putting your hands-on technical skills to the test in detecting, containing, and remediating incidents?
• Are you self-motivated and looking for an opportunity to rapidly accelerate your skills?
• Do you crave new and innovative work that actually matters to your customer?
• Do you have an Incident Response or Information Security background that you're not fully utilizing?
• Do you excel at communicating clearly and professionally with customers and colleagues?
• Do you love working around like-minded, smart people who you can learn from and mentor on a daily basis?
• Are you excited about the evolving role of AI in security operations, including AI models, prompt engineering, and agentic SOC workflows?

What You'll Do:

• Triage, investigate, and respond to security detections across endpoint, identity, email, network, and cloud environments.
• Conduct tactical analysis of EDR telemetry, log sources, and forensic artifacts to determine the root cause and scope of compromise, and develop targeted remediation recommendations.
• Investigate suspicious Microsoft 365 activity, including business email compromise (BEC) and adversary-in-the-middle (AITM) attacks, contain the threat, and deliver actionable guidance to customers.
• Perform basic malware analysis to support investigation and triage of security incidents.
• Develop and improve processes for incident detection and the execution of countermeasures.
• Deliver clear, concise, and professional customer communications as the primary point of contact during incident response activities.
• Produce high-quality written and verbal communications, recommendations, and findings to customers and internally.

What You'll Need:

• Incident Handling: hands-on experience conducting and coordinating incident response across a broad range of security events, including the ability to manage multiple simultaneous incidents across hosts and customer environments. Experience investigating threats including host/user compromises, network breaches, organized crime, and advanced persistent threats.
• Threat Landscape Awareness: strong working knowledge of attack vectors, threat actor tactics, techniques, and procedures (TTPs), with demonstrated experience applying frameworks such as MITRE ATT&CK to active investigations.
• Computer Forensic Analysis: hands-on experience using forensic analysis tools in incident response investigations to determine the extent and scope of compromise.
• Malware Analysis: demonstrated ability to perform basic static and dynamic malware analysis to understand the nature and behavior of malicious code.
• Operating System Fundamentals: strong understanding of Windows, Mac, and/or Linux operating systems with emphasis on Windows internals such as the file system, registry, scheduled tasks, and running processes.
• Systems Administration: hands-on experience administering networks and resolving connectivity, authentication, and configuration issues across small to large enterprise environments.
• Network Analysis Fundamentals: strong working knowledge of network protocols and analysis tools, with experience analyzing network traffic to support incident investigations.
• Identity Platform Awareness: experience working with identity and access management platforms such as Okta, Microsoft Entra , Active Directory, and similar enterprise technologies.
• Email Security Awareness: experience investigating Microsoft 365 security incidents, including business email compromise (BEC) and adversary-in-the-middle (AITM) attacks.
• Third-Party Log Analysis: working knowledge of log sources across cloud platforms, network devices, identity providers, email platforms, and other enterprise technologies, with experience conducting investigation and triage within a SIEM platform.
• Incident Remediation: basic understanding of surgical remediation actions needed to contain threats across compromised hosts, including third-party platform containment measures.
• Network Operations and Architecture/Engineering: working knowledge of secure network architecture and hands-on experience troubleshooting and navigating network environments.
• Programming/Scripting: experience with scripting languages such as Python, Power Shell, or Bash to support investigation workflows or automate repetitive tasks.
• AI Fundamentals: experience utilizing AI technologies to enhance decision-making, streamline workflows and processes, improve efficiency and drive business outcomes.

Additionally, all candidates must…