"Their likely duties would include:
- CrowdStrike Triage & Containment: Monitor off-hours alerts, filter false positives, and isolate compromised endpoints per playbook.
Phishing & Email Remediation: Review user-reported phish, purge malicious emails via Gmail/Okta, and block malicious domains.
- Off-Hours Incident Response: Serve as primary emergency contact during US nights to contain threats before US teams log on.
- Okta & Log Auditing: Conduct monthly log dumps across Okta, Google Workspace, and AWS to flag anomalous sign-ins or access drift.
- Vulnerability & Patch Tracking: Pull CrowdStrike Spotlight and Intune/NinjaOne reports to identify and track unpatched endpoints.
- Third-Party Risk Reviews: Assess new vendor SOC 2 reports and security questionnaires, flagging risks for US lead sign-off.
- Audit Evidence Collection: Gather recurring compliance evidence (access reviews, patch logs) for SOC 1/2, TX-RAMP, and ISO 27001.
- Security Queue SLA Management: Own and resolve daily incoming security and compliance tickets within target resolution times.
- CrowdStrike Rule Tuning: Fine-tune detection policies and exclusions to drastically reduce the high volume of false positives.
- Security Playbook Authoring: Convert tribal knowledge into step-by-step SOPs for email phish handling, laptop quarantine, and offboarding.
- Endpoint Gap Auditing: Cross-reference Okta, CrowdStrike, and MDM rosters to catch unmanaged devices missing security agents"
Application Confirmation
You're applying for the role below: