• Drive high levels of customer satisfaction, maintaining a strong sense of ownership over many customer relationships • Quickly triage and escalate noteworthy findings from Falcon Intelligence Recon to the respective customers • Understand the dark and deep web ecosystem; be able to properly convey analytical findings to customers • Guide customers through Falcon Intelligence Recon findings and providing subject matter expertise • Deliver regular written and verbal updates on relevant findings to customers, aligning with their preferred cadence • Be a strong voice for customers into the Intelligence and Engineering teams to improve the product and ensure that customer’s feedback, feature requests, and overall satisfaction is conveyed and accounted for • Plan and lead process improvement initiatives tailored to improve overall customer satisfaction with the CrowdStrike team

• Track adversary campaigns, tactics, techniques, and procedures (TTPs) • Author high-quality short and long format written reports independently • Generate reporting from a range of sources with minimal factual or accuracy errors • Actively engage with inter-team discussions, including participation and leadership of groups • Identify intelligence gaps and propose research projects to address collection shortfalls • Regularly conduct peer review of reporting by team members • Lead and participate in analytic discussions • Prioritize, categorize, and respond to requests for information from internal and external customers • Identify and contribute to customer engagements and requests as directed • Conduct briefings independently for a variety of customer levels • Identify opportunities for automation and process improvements • Track DPRK-nexus financial operations • Develop and maintain technical infrastructure tracking for DPRK-nexus adversaries • Contribute to team knowledge transfer through peer review, mentorship of junior analysts

• Research, design, and develop artificial intelligence and machine learning models. • Identify and evaluate opportunities for leveraging AI technologies across the organization. • Collect, prepare, and preprocess data from various sources for model training. • Train, validate, and optimize AI models using appropriate algorithms. • Integrate AI solutions into existing systems, applications, and workflows. • Monitor and maintain deployed AI models through performance tracking. • Collaborate with cross-functional teams to translate requirements into technical solutions.

Role Description The Cyber Threat Intelligence & Threat Hunting Lead will oversee integrated cyber threat intelligence (CTI), detection engineering, and proactive threat hunting operations supporting enterprise cyber defense missions. The Lead will drive development of intelligence-driven detections, hunt methodologies, adversary tracking, SIEM content engineering, and operational threat-informed defense capabilities. - Lead CTI, detection engineering, and threat hunting operations. - Develop intelligence-driven detection and hunt strategies. - Produce operational and strategic threat intelligence reporting. - Develop and maintain: - SIEM detections, - analytics, - correlation rules, - behavioral detections, - and hunt playbooks. - Conduct hypothesis-based threat hunting aligned to: - MITRE ATT&CK, - adversary TTPs, - malware campaigns, - and emerging threats. - Integrate CTI into SOC workflows, detection engineering, and incident response operations. - Analyze: - malware trends, - adversary infrastructure, - campaigns, - indicators, - and attack patterns. - Support automation and SOAR integration initiatives. - Brief executives and technical leadership on emerging threats and operational risk. Qualifications - 10+ years of cybersecurity operations experience. - 5+ years supporting CTI, threat hunting, or detection engineering programs. - Experience with: - Splunk, - Sentinel, - CrowdStrike, - EDR telemetry, - detection content engineering, - and intelligence platforms. - Strong understanding of: - MITRE ATT&CK, - adversary tradecraft, - malware analysis, - and intelligence analysis methodologies. - Experience developing: - SIEM detections, - hunt analytics, - detection tuning, - and operational reporting. Preferred Certifications - GCTI - GCFA - GCIH - GMON - GCDA - CISSP - Splunk Security certifications