Job Title: CrowdStrike Engineer
Location: Hybrid - Skokie, IL Arlington Heights, IL or Warrenville, IL (Partial Remote)
Duration: Contract to hire
Job Summary:
As the Security Engineer II – CrowdStrike Subject Matter Expert at Client, you will be the lead engineer and in-house expert for the organization's CrowdStrike platform. You will own the configuration, protection policies and ongoing improvement of CrowdStrike across the enterprise. This is a hands-on engineering role, not an incident response role. The ideal candidate has configured policies, led rollouts, moved environments to stricter policies and set up the platform's various components. They have not only used CrowdStrike to resolve alerts.
A key focus of this role is leading the rollout of CrowdStrike Guardian, CrowdStrike's new AI detection and response tool for data loss prevention (DLP) and AI protection. Guardian will replace the current DLP agent. The rollout has already started with a pilot alongside the End-User Computing team. You will also work closely with the organization's managed security services provider (MSSP), which co-manages the environment, and you will support the enterprise email security program on Microsoft E5.
In addition, you will help improve the organization's cybersecurity posture and keep watch over its data, systems and resources. You will help carry out the enterprise security strategy, create security policies and standards, review systems for compliance, and support risk management, governance and incident response. Responsibilities include maintaining alignment with HIPAA, PCI and other applicable laws, regulations and standards.
What you will do:
- Serve as the lead engineer and subject matter expert for the CrowdStrike platform, owning all protection policies, platform configuration and component setup.
- Lead the rollout of CrowdStrike Guardian for data loss prevention and AI protections, including pilot activities with End-User Computing and the transition off the current DLP agent.
- Design, configure, tune and move CrowdStrike policies to more stringent security standards over time, balancing protection with business and clinical operations.
- Plan and carry out CrowdStrike deployments, rollouts and configuration changes across the enterprise.
- Partner with the organization's MSSP, which co-manages the environment. Direct configuration changes and review alerts escalated by the MSSP.
- Support enterprise email security using Microsoft E5, including making sure email authentication standards such as SPF, DKIM and DMARC are properly configured and maintained.
- Identify threats and vulnerabilities. Conduct complex security incident reviews and investigations, and support incident response and recovery activities.
- Architect, design and implement security technologies and processes as directed by leadership, in collaboration with departmental colleagues and business and application owners.
- Manage, administer, monitor and support 2–3 security applications, with CrowdStrike as the primary platform. Troubleshoot and resolve problems with cybersecurity technologies, and automate operational use of these tools to reduce risk.
- Cross-train team members on CrowdStrike operational processes.
- Measure and report on enterprise security capabilities using automated and manual tools.
- Develop and maintain security policies, standards and standard operating procedures. Share security strategies, standards and procedures with IT and business partners.
- Participate in reviews of new or existing systems to confirm they meet security requirements, including risk and impact assessments before and after implementation.
- Respond to and assist with audits, assessments and compliance requests, including HIPAA Security and Privacy rules and Payment Card Industry (PCI) standards.
- Participate in an on-call rotation with peers to address incidents as they are assigned, including reporting on site during a crisis or major incident when needed.
- Execute all other duties as assigned.
What you will need:
- Education: Bachelor's degree, or equivalent, in a technical discipline, or a similar educational background with professional-level security certifications relevant to the role.
- Certification: One advanced, professional or expert-level security certification preferred.
- Experience: Minimum three (3) years of mid-level cybersecurity experience at an analyst or engineer level.
- Expert-level, hands-on engineering experience with CrowdStrike, including policy configuration, platform deployments and rollouts, and component configuration. Experience that is only in incident response or alert handling is not sufficient.
- Previous experience leading, supporting, managing and administering at least one security application.
- Previous experience leading security projects and initiatives.
- IT experience that aligns with Endeavor Health's enterprise security stack.
Unique or Preferred Skills:
- Experience with CrowdStrike Guardian or other data loss prevention (DLP) and AI protection tools. Guardian is a new tool, so hands-on experience is not expected.
- Strong understanding of email security and email authentication protocols, including SPF, DKIM and DMARC.
- Experience with Microsoft E5 security capabilities, particularly email security. Exposure to Proofpoint is a plus.
- Ability to work independently with minimal oversight on a broad range of security projects and initiatives.
- Demonstrated in-depth knowledge of information security principles, practices, solutions and capabilities.
- Demonstrated understanding of advanced security incident investigation techniques.
- Intermediate understanding of threats and risks.
- Intermediate-level knowledge of network, application and systems security architecture.
- Leadership and project management skills.
- Proven communication, customer service and organization skills.
- Previous experience with HIPAA, NIST and project management.
