Analyst I, Falcon Complete (Hybrid, San Antonio)

CrowdStrike•San Antonio, TX

10d•Hybrid

About The Position

CrowdStrike is seeking a highly motivated, self-driven technical analyst to help protect organizations from advanced attackers. The role is part of CrowdStrike’s virtual security operations center, where analysts detect and respond to customer incidents in real time. The position is open to candidates in San Antonio, Texas, and requires a 4x10 schedule that includes one weekend day. The analyst triages, investigates, and responds to security detections across endpoint, identity, email, network, and cloud environments. The role includes analyzing EDR telemetry, logs, and forensic artifacts; investigating Microsoft 365 activity, including BEC and AITM attacks; performing basic malware analysis; and recommending and carrying out threat containment and remediation. The analyst serves as a primary customer contact during incident response, communicating findings and actionable guidance clearly and professionally. Candidates should be capable of completing technical tasks without supervision and be motivated to develop their technical and communication skills. A BA/BS or MA/MS in a related field is listed, though applicants without a degree may be considered if they have relevant work experience and/or training. The position may periodically require alcohol and/or drug testing during employment. The posted U.S. base salary range is $85,000–$120,000 per year, with eligibility for bonuses, equity grants, and a benefits package.

Requirements

Experience in one or more relevant areas, including incident handling, threat analysis, computer forensics, malware analysis, operating systems, systems administration, network analysis, identity platforms, email security, third-party log analysis, incident remediation, network operations, programming or scripting, or AI fundamentals.
Hands-on incident response experience, including coordinating responses to a range of security events and managing multiple incidents across hosts and customer environments.
Experience investigating threats such as host or user compromises, network breaches, organized crime, and advanced persistent threats.
Working knowledge of attack vectors and threat actor tactics, techniques, and procedures, with demonstrated application of frameworks such as MITRE ATT&CK to investigations.
Experience using forensic analysis tools to determine the extent and scope of compromise.
Ability to perform basic static and dynamic malware analysis.
Strong understanding of Windows, Mac, and/or Linux, particularly Windows internals such as the file system, registry, scheduled tasks, and running processes.
Hands-on experience administering networks and resolving connectivity, authentication, and configuration issues in enterprise environments.
Working knowledge of network protocols and analysis tools, including experience analyzing network traffic during investigations.
Experience with identity and access management platforms such as Okta, Microsoft Entra ID, and Active Directory.
Experience investigating Microsoft 365 security incidents, including BEC and AITM attacks.
Working knowledge of logs from cloud platforms, network devices, identity providers, email platforms, and other enterprise technologies, and experience investigating and triaging within a SIEM platform.
Basic understanding of targeted remediation actions to contain threats on compromised hosts and through third-party platforms.
Working knowledge of secure network architecture and hands-on experience troubleshooting and navigating network environments.
Experience using scripting languages such as Python, PowerShell, or Bash to support investigations or automate repetitive tasks.
Experience using AI technologies to improve decision-making, streamline workflows, increase efficiency, and drive business outcomes.
Ability to complete technical tasks without supervision.
Desire to grow technical and soft skills and contribute to a positive work environment.
Willingness to work a 4x10 schedule that includes a day on the weekend.
BA/BS or MA/MS in Computer Science, Computer Engineering, Math, Information Security, Information Assurance, Information Security Management, Intelligence Studies, Cybersecurity, Cybersecurity Policy, or a related field; applicants without a degree may be considered with relevant work experience and/or training.

Responsibilities

Triage, investigate, and respond to security detections across endpoint, identity, email, network, and cloud environments.
Analyze EDR telemetry, log sources, and forensic artifacts to determine the root cause and scope of compromise and develop targeted remediation recommendations.
Investigate suspicious Microsoft 365 activity, including business email compromise (BEC) and adversary-in-the-middle (AITM) attacks; contain threats and provide actionable customer guidance.
Perform basic malware analysis to support security incident investigation and triage.
Develop and improve incident detection processes and the execution of countermeasures.
Serve as the primary point of contact for customers during incident response activities and deliver clear, concise, professional communications.
Produce written and verbal communications, recommendations, and findings for customers and internal stakeholders.