Senior Security Specialist

Team: Cyber Platforms  |  Suggested classification: Security Engineer - Senior

Role purpose

Build, deploy and improve CrowdStrike Falcon platform capabilities across endpoint and cloud environments. The role combines Falcon platform engineering with secure cloud-native development, integration and automation, while partnering with the SOC and cloud teams to improve detection and response outcomes.

Suggested level

Senior Engineer or experienced Engineer with demonstrable production ownership

Primary accountability

Falcon platform components, sensor coverage, policies, integrations, cloud workload protection, automation and platform health.

Delivery model

Hands-on build, test, deployment, operational support and knowledge transfer to internal and Infosys teams.

Key interfaces

Cyber Platforms TPO, SOC, cloud and Kubernetes teams, endpoint services, ServiceNow, identity, network and application teams.

Key responsibilities

• Build, configure and maintain Falcon components including sensor deployment and health, host groups, prevention and response policies, exclusions, access controls and update rings appropriate to deployed licences.
• Engineer reliable Falcon coverage for GCP compute and Kubernetes workloads, partnering on cloud account integration, sensor or operator deployment, admission controls and image analysis where in scope.
• Create and maintain Terraform modules and deployment pipelines for supported Falcon resources, cloud integration and Kubernetes components.
• Build Python automation and, where required, Java services or integrations using Falcon APIs, SDKs, event streams and approved enterprise interfaces.
• Integrate Falcon detections, incidents, asset and response data into Google SecOps, ServiceNow and other approved workflows; validate mapping, event quality, latency and case traceability.
• Design and tune detection and response policies, indicators and orchestration workflows with SOC analysts; measure coverage, noise, speed and operational impact.
• Evaluate AI-assisted triage and response capabilities with human review, approvals, auditability, test cases and false-positive safeguards before production use.
• Investigate platform health, sensor coverage gaps, policy conflicts and failed integrations; maintain runbooks, test evidence, change records and knowledge transfer.

Mandatory skills and experience

• Hands-on production engineering of CrowdStrike Falcon, including deployment, policy configuration, sensor lifecycle, host grouping, exclusions, RBAC and troubleshooting.
• Practical experience using Falcon APIs and Python for automation, workflow integration and event processing, including authentication, scopes, retries and failure handling.
• Strong Terraform experience for repeatable platform and cloud configuration, with modules, state, pipelines, testing and drift management.
• GCP knowledge covering organisations, projects, IAM, service accounts, compute, networking and secure workload integration.
• Kubernetes and container security knowledge covering clusters, namespaces, images, admission controls, runtime instrumentation and controlled rollouts.
• Experience building or maintaining cloud-native integrations in Python and Java, including APIs, testing, observability and secure deployment.
• Understanding of endpoint and cloud threat detection, policy tuning, incident response and SOC handoff.

Desirable skills and experience

• Experience with Falcon Cloud Security, Fusion SOAR, Foundry or Charlotte AI capabilities where deployed and licensed.
• CrowdStrike Terraform provider and Kubernetes deployment module experience.
• Google SecOps, ServiceNow, vulnerability tooling, CI or CD and enterprise identity integration experience.
• Production Java development depth, especially event-driven or containerised services.
• Experience in regulated financial services and platform continuity.

Expected deliverables

• Documented Falcon platform baseline, component inventory, policy map, integration map, sensor coverage and known gaps.
• Tested Terraform modules and pipelines for repeatable configuration, GCP onboarding and Kubernetes coverage.
• Production-ready Python or Java integrations with controls, tests, logs, monitoring, runbooks and ownership.
• Validated detection and response improvements, including AI-assisted workflow assessment with defined human control points.
• Coverage and health reporting, integration test results, change records and a prioritised improvement backlog.

Assessment guidance

Require evidence of personal contribution and production outcomes. Use a scenario-based interview or practical exercise; product keywords alone are insufficient.

Assessment area

Evidence expected

Weight

Falcon engineering

Sensor, policy, platform health and API work, including contribution and scale.

30%

Cloud and IaC

GCP, Kubernetes and Terraform deployments, testing and release controls.

25%

Software integration

Python and Java examples, API design, secure coding and operational support.

20%

Detection response

Control tuning, SOC handoff, workflows and AI-assisted capability evaluation.

15%

Operations

Documentation, communication, incident and change follow-through.

10%