Description

You will build and maintain automated security pipelines integrating endpoint telemetry with SIEM platforms.

Responsibilities

• Stand up and harden the FDR to S3 delivery for Falcon Device Control events, ensuring schema normalization.
• Configure Microsoft Sentinel ingestion for FDR data and AD/Entra ID events, developing KQL parsers and tables for correlation.
• Author KQL analytics/rules joining Windows Event IDs (4728/4729/6416/4663) with CrowdStrike events to drive host policy changes.
• Build idempotent automation using PowerShell, Python, or Logic Apps to call CrowdStrike APIs based on Sentinel signals, including audit logging.
• Develop unit and integration tests for parsers and functions, and document full runbooks for operations.

Required Skills

• 5+ years in security engineering/automation with SIEM (Microsoft Sentinel) and endpoint security integrations.
• Proficiency in KQL, Python, and/or PowerShell, and REST/OAuth2 API integration.
• Hands-on experience with CrowdStrike Falcon (preferably Device Control) and FDR pipelines.
• Solid understanding of Windows Security Event Log semantics, specifically 4728/4729, 6416, and 4663.
• Cloud data engineering basics, including AWS S3 object lifecycle and secured ingestion.
• Experience with CI/CD practices for packaging automation artifacts.
• Familiarity with Azure identity fundamentals and Entra ID group modeling.

Key Skills

Education

Any Gradute