Opportunity Summary:SP6 is seeking a full-time consultant to join our services teams in North America.
Falcon is much more than endpoint detection and response (EDR). It is a unified security platform spanning endpoint, identity, cloud, data protection, SIEM, and AI security. This role focuses on two of its fastest-growing areas: Falcon Next-Gen SIEM (Falcon NG-SIEM) and Falcon AI Detection and Response (AIDR), with hands-on work across Falcon Fusion SOAR, Falcon Onum, and Falcon Foundry.
You will be a hands-on expert for our customers and a technical resource for our own team, answering questions and cross-training colleagues as our CrowdStrike practice grows. Consultants work on many use cases across different industries and multiple Falcon modules.
Responsibilities:You'll support customers through two delivery models, often working with several customers at once:
- Residency engagements: longer-term engagements embedded with a customer, typically lasting from a few months to a year
- Outcome-based engagements: project work with defined milestones and deliverables delivered within an agreed timeline
- Managed services: ongoing, recurring support in which SP6 operates and maintains the customer's Falcon environment as an extension of their security team
- Architect, deploy, and tune Next-Gen SIEM: onboard data sources, build parsers, write detections and dashboards, and support migrations from other SIEMs
- Help customers adopt AIDR (Guardian) to secure workforce AI usage and in-house AI applications and agents
- Design and configure playbooks, workflows, and integrations in Fusion SOAR
- Design and configure in Falcon Onum listeners, pipelines and datasinks
- Design and configure custom apps for custom applications using Falcon Foundry
- Lead deployments, migrations, health checks, and outcome-based projects from requirements gathering through handoff
- Provide ongoing administration of customers' Falcon environments, including policy and sensor management, detection tuning, platform health monitoring, and regular reporting against service levels
- Leverage previous experience, share best practices, and create innovative solutions that maximize customers' value from Falcon and aid in user adoption
- Provide knowledge transfer to customers throughout each engagement
- Serve as a hands-on CrowdStrike resource for our internal team, answering technical questions and cross-training colleagues
- Manage your time across multiple concurrent customers, setting clear expectations and keeping each engagement moving
- Develop and continually extend expertise across the Falcon platform and the broader security landscape
RequirementsRequirements:- Hold active CrowdStrike certifications: CrowdStrike Certified Falcon Administrator (CCFA) and CrowdStrike Certified SIEM Engineer (CCSE)
- 1+ years of hands-on CrowdStrike Falcon experience, including Next-Gen SIEM
- Preferably has experience with AIDR
- 3+ years of cybersecurity experience, preferably in SOC operations, security engineering, threat detection, or incident response
- Understanding of security log sources, normalization, correlation, and detection dependencies.
- Working knowledge of MITRE ATT&CK, NIST CSF, OWASP and incident response processes
- Strong understanding of security technologies: EDR/XDR, firewalls, IDS/IPS, WAF, DNS, proxy, IAM, Active Directory, and cloud security.
- Experience writing queries, detections, and dashboards in CrowdStrike Query Language (CQL)
- Experience in requirements gathering, documenting requirements, requirement analysis, and testing
- Proven ability to manage multiple customers or projects at the same time, in a project-based or ongoing managed services setting
- Excellent verbal and written communication skills, including explaining technical topics to non-technical audiences
BenefitsWhy SP6? - The chance to lead a team in a high-growth markets
- Comprehensive medical, dental, and vision plans.
- 401(k) with company match
- 30 days annual paid time off
- Significant Training and Development and Certification attainment.
- Opportunity for long-term career advancement.
- Your contributions are felt and recognized at our growing company
These services co-exist with legacy expertise and services from SP6 in the Security Operations (SIEM), as the SIEM is an organization's primary tool for security detection and analysis; as well as our existing Cyber Compliance expertise in Cyber Risk & Compliance (CRC) services.
