Incident Response Principal Consultant (Remote)

CrowdStrike•USA WA Remote, WA

1d•$140,000 - $195,000•Remote

About The Position

CrowdStrike is seeking a highly motivated, self-driven technical consultant for its CrowdStrike Services team. The role supports organizations facing advanced cyber attackers and includes a variety of engagements, including high-profile incident response investigations. The consultant will lead investigations, develop methods to hunt for malicious actors, conduct host and network forensics, perform basic malware analysis, and communicate findings to customer, regulatory, and legal stakeholders. The position also involves demonstrating industry thought leadership through public content and speaking engagements. The role is remote and may require travel on short notice, up to 30% of the time. It may also require periodic alcohol and/or drug testing during employment. Candidates should bring experience in one or more relevant areas, such as incident response, computer or network forensics, reverse engineering, incident remediation, network operations and architecture, cloud incident response, or communications. Candidates must be able to complete technical work without supervision, manage projects, contribute thought leadership, work positively with others, and demonstrate experience using AI technologies to improve decision-making, workflows, efficiency, and business outcomes. A bachelor's or master's degree in a relevant technical, security, intelligence, or related field is listed; applicants without a degree may be considered if they have relevant work experience and/or training.

Requirements

Experience in one or more relevant areas, such as team leadership in a matrixed consulting environment; incident response; computer forensic analysis; network forensic analysis; reverse engineering; incident remediation; network operations and architecture/engineering; cloud incident response; or client and team communications.
For incident response experience: experience conducting or managing investigations for organizations and investigating targeted threats such as advanced persistent threats, organized crime, and hacktivists.
For computer forensic analysis: experience using a variety of forensic analysis tools in incident response investigations to determine the extent and scope of compromise.
For network forensic analysis: strong knowledge of network protocols and network analysis tools such as Bro/Zeek or Suricata, and ability to analyze associated network logs.
For reverse engineering: ability to understand the capabilities of static and dynamic malware analysis.
For incident remediation: strong understanding of targeted attacks and ability to create customized tactical and strategic remediation plans for compromised organizations.
For network operations and architecture/engineering: strong understanding of secure network architecture and a strong background in performing network operations.
For cloud incident response: knowledge of incident response methodologies for one or more of AWS, Azure, and GCP.
Strong ability to communicate executive-level and/or detailed findings to clients and communicate tasks, guidance, and methodology effectively with internal teams.
Proven experience using AI technologies to enhance decision-making, streamline workflows and processes, improve efficiency, and drive business outcomes.
Ability to complete technical tasks without supervision.
Desire to grow and expand technical and soft skills.
Strong project management skills.
Contributing thought leader within the incident response industry.
Ability to foster a positive work environment and attitude.
Ability to travel on short notice, up to 30% of the time.
A BA/BS or MA/MS in Computer Science, Computer Engineering, Math, Information Security, Information Assurance, Information Security Management, Intelligence Studies, Cybersecurity, Cybersecurity Policy, or a related field; applicants without a degree but with relevant work experience and/or training will be considered.

Responsibilities

Lead incident response engagements.
Develop and use new methods to hunt for bad actors across large sets of data.
Conduct intrusion investigations under the direction of outside counsel.
Perform host and/or network-based forensics across Windows, Mac, and Linux platforms.
Perform basic malware analysis.
Produce written and verbal reports, presentations, recommendations, and findings for stakeholders, including customer management, regulators, and legal counsel.
Demonstrate industry thought leadership through blog posts, CrowdCasts, and other public speaking events.