Senior Manager - CrowdStrike AIDR Engineer

Kroll Cyber & Data Resilience Manager or Senior Manager

At Kroll, we provide reactive, advisory, transformation, and managed security services to support clients at every stage of their path toward cyber and data resilience maturity. Our experts bring decades of experience in cyber risk consultancy, helping organizations across the world simplify and reduce the complexity of implementing, transforming, and managing their cyber programs. Through our strategic multi-year partnership with Crowd Strike, we combine world-class investigative expertise with an AI-native platform to redefine the future of managed detection and response, delivering faster outcomes, stronger protection, and greater resilience for organizations worldwide.

The Cyber & Data Resilience capability (formerly Engineered Defense) is hiring a Manager or Senior Manager to build and lead Kroll's Crowd Strike Falcon AI Detection and Response (AIDR) deployment practice. With the GA of Falcon AIDR, Crowd Strike extended the Falcon platform to secure the AI prompt and agent interaction layer — protecting workforce GenAI use and homegrown AI applications and agents through one sensor and one console, with deployment via browser extension, application SDK, AI/API gateway integration, and MCP proxy.

Kroll clients need a partner who can deploy, configure, integrate, and tune Falcon AIDR end-to-end inside their Falcon tenant — getting AIDR turned on across the right deployment surfaces, wiring its telemetry into Falcon Next-Gen SIEM, building Fusion SOAR playbooks for AI events, integrating with Falcon Cloud Security and Falcon Data Protection, and tuning prompt-attack and data-protection policies to each client's AI usage patterns.

This is a player-coach role. The "Manager" or "Senior Manager" title does not mean hands-off oversight. You will personally lead engagement delivery — standing up AIDR in client tenants, integrating it with the rest of the Falcon stack, configuring policies, and tuning detections — while mentoring junior consultants and partnering with Crowd Strike account teams on scoping.

This role reports into the Engineered Defense / Tech Transformation leadership team and partners closely with Kroll's Cloud Security, Identity, Next-Gen SIEM, and Crowd Strike Services delivery teams.

• Stand up Falcon AIDR in client tenants — provisioning, sensor configuration, console setup, and verification of telemetry flow.
• Roll out the browser extension for workforce AI visibility and policy enforcement on employee GenAI usage.
• Integrate the AIDR SDK into client AI applications and agents (Lang Chain, Llama Index, Auto Gen, AWS Bedrock Agents, Microsoft Copilot Studio, custom-built agent frameworks).
• Deploy the MCP proxy to instrument Model Context Protocol traffic for agent security.
• Configure AI/API gateway integrations for inline prompt inspection and response.
• Enable AIDR coverage of AI workloads in Kubernetes through Falcon Cloud Security, including runtime detection at the prompt layer with no proxies or architectural changes.

• Configure prompt-attack detection policies — tuning sensitivity for direct prompt injection, indirect prompt injection, jailbreaks, multi-modal (text + image) attacks, and unsafe content across the client's AI tools and applications.
• Configure sensitive data protection policies — defining custom data categories, redaction patterns, masking rules, and encryption behaviors for credentials, regulated data, and client-specific confidential information before it reaches models, agents, or external AI systems.
• Configure policy enforcement across users, agents, tools, and models — including block, mask, encrypt, and allow-with-audit responses.
• Configure runtime AI event logging — capturing full prompt and response content, AI model versions, users, and relationship mapping between users, prompts, models, agents, and MCP servers.
• Build and tune custom detection content mapped to MITRE ATLAS adversarial ML techniques (AML.T0051 LLM Prompt Injection, AML.T0054 LLM Jailbreak, AML.T0048 External Harms) as detection vocabulary inside AIDR.

• Wire AIDR telemetry into Falcon Next-Gen SIEM (Log Scale) — building…