Senior Manager – Cloud Security Engineer (CrowdStrike)

Kroll is seeking a Senior Manager – Cloud Security Engineer (CrowdStrike) to launch and lead its Falcon Cloud Security deployment practice for clients across the United States. This is a hands-on, player-coach role for an engineer who wants to architect cloud-native defenses while mentoring the next generation of consultants.

About the Role

Within Kroll's Cyber & Data Resilience capability, you will build and run the practice responsible for deploying, configuring, integrating, and tuning CrowdStrike Falcon Cloud Security end-to-end inside each client's Falcon tenant. Falcon Cloud Security is a unified Cloud-Native Application Protection Platform (CNAPP) covering CSPM, CWP, CIEM, KSPM, ASPM, DSPM, IaC scanning, and container and Kubernetes runtime protection across AWS, Azure, and Google Cloud. Reporting into the Engineered Defense / Tech Transformation leadership team, you will personally drive engagement delivery while guiding junior consultants and collaborating with CrowdStrike account teams on scoping. The position is full-time and based in the United States.

Key Responsibilities

• Onboard client AWS, Azure, and GCP environments to Falcon Cloud Security at scale using CloudFormation StackSets, Bicep / Entra ID integrations, and GCP service account patterns.
• Deploy the Falcon sensor across VMs, container hosts, and Kubernetes nodes, and stand up agentless snapshot scanning to close coverage gaps.
• Roll out the Kubernetes Admission Controller, container image registry scanning, IaC scanning, and serverless protection into client CI/CD pipelines.
• Configure CSPM, CWP, KSPM, ASPM, DSPM, and CIEM policies, including IOM and IOA rules, compliance frameworks (CIS, NIST, PCI-DSS, HIPAA, SOC 2), and ExPRT.AI risk prioritization.
• Ingest cloud telemetry into Falcon Next-Gen SIEM (LogScale) and build detection content mapped to the MITRE ATT&CK Cloud Matrix.
• Develop Falcon Fusion SOAR playbooks and integrate with Falcon Identity Protection, Insight (EDR), AIDR, and Charlotte AI workflows.
• Tune IOM/IOA policies and validate detection coverage through controlled adversary emulation.

Qualifications

• Deep hands-on expertise with CrowdStrike Falcon Cloud Security and the broader Falcon platform.
• Strong working knowledge of AWS, Azure, and GCP architecture, identity, and logging.
• Proven experience with Kubernetes, container security, IaC, and CI/CD integrations.
• Detection engineering skills, including CQL and MITRE ATT&CK-aligned content development.
• Demonstrated ability to lead delivery while mentoring consultants and partnering with stakeholders.

About Kroll

Kroll delivers reactive, advisory, transformation, and managed security services that help organizations worldwide advance their cyber and data resilience. Through a strategic multi-year partnership with CrowdStrike, Kroll pairs decades of investigative expertise with an AI-native platform to redefine managed detection and response.

How to Apply

To apply, complete your application directly on this page, or you'll be redirected to the employer's application platform to finish submitting there.