Role Description This project will optimize the agency's CrowdStrike SIEM and related CrowdStrike services to improve threat detection, monitoring, and response capabilities. - The contractor will expand and tune telemetry, integrate additional high-value log sources, enhance security dashboards, and support the rollout of additional CrowdStrike services. - The effort will increase visibility into endpoint and security risk, improve signal quality and correlation, and provide security leadership with clear insight into security operations effectiveness and overall risk posture. Expected Outcomes: - Expanded and optimized CrowdStrike SIEM telemetry coverage - Integration of additional high-value log sources - Improved dashboards for operational and executive visibility - Enhanced detection fidelity and monitoring effectiveness - Clearer insight for leadership into endpoint risk and security operations performance Duties to Be Performed: - Assess current CrowdStrike SIEM configuration, telemetry coverage, and log ingestion - Enable and tune additional CrowdStrike telemetry to improve visibility and signal quality - Identify and integrate new high-value log sources into CrowdStrike SIEM - Develop and refine security dashboards aligned to SOC and executive use cases - Assist with technical enablement and rollout of additional CrowdStrike services - Validate data quality, parsing, and correlation within the SIEM - Coordinate with Security Operations, IT Operations, and system owners - Identify gaps, risks, and improvement opportunities in monitoring and detection - Provide weekly status updates and monthly executive-level progress summaries - Deliver supporting documentation and recommendations to sustain improvements Deliverables: - Summary of work performed and capabilities delivered - Documentation supporting all telemetry enablement, log integrations, and dashboard implementations - Measurable improvements in monitoring, detection, or visibility - Recommendations for future enhancements or next-phase efforts Qualifications - 8 years of demonstrated skill with documentation, reporting, and knowledge transfer (Required) - 8 years of experience with Stakeholder Engagement, and Executive Communication (Required) - 8 years of experience in SIEM Detection Engineering and Alert Optimization (Required) - 8 years of experience in Log Source Integration and Data Normalization (Required) - 3 years of hands-on experience with CrowdStrike SIEM and Dashboard Development (Required) - 5 years of hands-on experience with SIEM and Dashboard Development (Preferred) Requirements - Candidates that do not meet or exceed the minimum stated requirements (skills/experience) will be displayed to customers but may not be chosen for this opportunity. Company Description - Solicitation Reference Number: 70126092 - Customer/Dept: Texas Education Agency

• Lead the final phase of Sensiba's Zero Trust transformation and endpoint security modernization. • Develop, document, and maintain enterprise security standards and configuration baselines. • Establish scalable security practices that support long-term growth and compliance. • Manage and optimize Microsoft Sentinel for monitoring, detection, and response activities. • Develop and tune detection rules, alerts, investigations, and automated response workflows. • Lead security investigations, incident response efforts, and proactive threat hunting activities. • Own Defender XDR, Defender for Endpoint, and Defender for Cloud administration and security posture management. • Monitor and remediate vulnerabilities across user devices and cloud environments. • Manage Microsoft Purview Data Loss Prevention (DLP) policies and information protection programs. • Support Sensiba's annual SOC 2 Type II audit process by producing technical evidence and validating controls.

• Develop, execute, and evaluate cybersecurity exercises • Manage cyber threats by monitoring and responding to security incidents • Design and implement security controls for organization’s infrastructure • Analyze malware to understand behavior and defend against it • Simulate cyberattacks to identify vulnerabilities in systems

• Serve as the regional operations lead for data center physical security in Australia: run site security programs, coordinate with site operators and contract guard forces, and own in-region incident response and escalation • Administer and operate the region's electronic security systems access control, video management (VMS), intrusion detection, and visitor management including configuration, health monitoring, and lifecycle management • Design and document security systems architecture: device schedules, integration points, data flows, and network topology for security infrastructure at new and existing sites • Build and maintain integrations that bring security data sources (video, access events, alarms, sensors) into centralized monitoring and analysis platforms • Support construction-phase security for new builds and modular deployments in region: design reviews, commissioning of security systems, and security gates before handover • Manage regional security vendors and integrators scoping, delivery quality, and accountability • Write and maintain the operational backbone: post orders, standard operating procedures, and audit-ready documentation for regional security controls • Provide after-hours coverage and structured handoffs to US-based teams as part of follow-the-sun security operations