Senior Manager, CrowdStrike Cloud Security, Cyber Engineered Defense

Kroll is a global leader in risk and financial advisory solutions, providing a range of managed security services. They are seeking a Senior Manager to lead the CrowdStrike Falcon Cloud Security deployment practice, overseeing the onboarding, configuration, and integration of cloud security solutions for clients.

Responsibilities:

• Onboard client AWS, Azure, and GCP environments to Falcon Cloud Security at scale — using AWS CloudFormation StackSets across AWS Organizations, Bicep / Entra ID integrations for Azure tenants and management groups, and service account patterns for GCP projects and folders
• Deploy the Falcon sensor across cloud workloads — EC2 / Azure VMs / GCE instances, container hosts, Kubernetes nodes — and stand up agentless snapshot-based scanning to fill coverage gaps
• Deploy the Kubernetes Admission Controller to enforce pre-runtime policy on workload admission across EKS, AKS, GKE, and self-managed Kubernetes
• Roll out container image registry scanning and IaC scanning (Terraform, CloudFormation, ARM/Bicep, Kubernetes manifests, Helm) into client CI/CD pipelines (GitHub Actions, GitLab CI, Jenkins, Azure DevOps)
• Enable serverless protection for AWS Lambda, Azure Functions, and GCP Cloud Functions
• Stand up CIEM across cloud identity providers (IAM users, roles, service accounts, managed identities) for least-privilege analysis
• Configure CSPM policies — IOM rules, custom misconfiguration detections, compliance frameworks (CIS Benchmarks, NIST, PCI-DSS, HIPAA, SOC 2), and exception management
• Configure CWP runtime policies — IOA detections, prevention policies, container runtime protection, drift detection
• Configure KSPM policies — Kubernetes posture, pod security standards, admission control rules, RBAC analysis
• Configure ASPM and DSPM policies for application-security posture and data-security posture across cloud data stores
• Configure CIEM — effective permission analysis, toxic combinations, privilege right-sizing, service-account hygiene
• Configure ExPRT.AI risk prioritization to surface attack paths and toxic combinations across CSPM/CWP/CIEM signals
• Build and tune custom detection content (IOAs, IOMs, CQL queries) for cloud-native attack techniques mapped to MITRE ATT&CK Cloud Matrix
• Ingest cloud log telemetry into Falcon Next-Gen SIEM (LogScale) — AWS CloudTrail, GuardDuty findings, VPC Flow Logs, S3 access logs; Azure Activity Log, Defender for Cloud alerts, NSG Flow Logs, Entra ID sign-in logs; GCP Audit Logs, VPC Flow Logs, Security Command Center findings; EKS / AKS / GKE control plane logs; Kubernetes audit logs
• Build detection engineering content in Next-Gen SIEM correlating Falcon Cloud Security findings with cloud provider native logs, endpoint telemetry, and identity events for full attack-path visibility
• Build Falcon Fusion SOAR playbooks for cloud-native response actions: quarantine compromised workload, revoke IAM credential, isolate Kubernetes pod, remediate misconfiguration via IaC pull request, trigger MFA via Falcon Identity Protection
• Integrate Falcon Cloud Security with Falcon Identity Protection for cross-domain correlation between cloud workload activity and identity risk
• Integrate Falcon Cloud Security with Falcon Insight (EDR) for unified endpoint + cloud workload protection
• Integrate Falcon Cloud Security with Falcon AIDR for AI workload runtime protection in Kubernetes
• Build Charlotte AI prompts and agentic workflows for cloud event triage, misconfiguration remediation guidance, and executive cloud-risk reporting
• Tune IOM and IOA policies to reduce false positives without sacrificing detection efficacy
• Tune ExPRT.AI prioritization and attack path analysis to client risk tolerance and remediation capacity
• Optimize sensor performance and agentless scan cadence for cost and coverage balance
• Validate detection coverage through controlled adversary emulation against the MITRE ATT&CK Cloud Matrix
• Hand off operational runbooks to client cloud security teams and Kroll Managed Services for ongoing operation
• Advise client cloud platform, DevSecOps, and SOC engineering teams on Falcon Cloud Security deployment architecture — agent vs. agentless coverage decisions, account onboarding patterns, Kubernetes admission control posture, IaC scanning policy in CI/CD, and integration with existing Falcon modules
• Partner with CrowdStrike account teams on Falcon Cloud Security pre-sales scoping, solution design, proof-of-value engagements, and joint go-to-market motions
• Develop reusable Falcon Cloud Security deployment runbooks, configuration templates (Terraform, Bicep), integration patterns, Fusion SOAR playbook libraries, custom IOM/IOA detection libraries, and Charlotte AI workflow templates
• Mentor consultants on Falcon Cloud Security deployment and integration

Requirements:

• 5+ years (Manager) or 7+ years (Senior Manager) of hands-on experience deploying, configuring, and operating cloud security tooling in enterprise environments — with a meaningful concentration in CNAPP, CSPM, CWP, or container/Kubernetes security
• Hands-on deployment experience with the CrowdStrike Falcon platform — direct experience with Falcon Cloud Security (CSPM, CWP, CIEM, KSPM, IaC scanning) is required. Equivalent hands-on with a competing CNAPP (Wiz, Prisma Cloud, Lacework, Aqua, Sysdig, Orca) plus willingness to ramp on Falcon Cloud Security is acceptable
• Demonstrated experience deploying, configuring, and integrating cloud security platforms across AWS, Azure, and GCP — not just operating them post-deployment. Working depth across at least two of the three hyperscalers is required
• Hands-on with Kubernetes security — EKS, AKS, GKE, or self-managed; Pod Security Standards; admission controllers; RBAC; container runtime protection
• Hands-on with Infrastructure as Code — Terraform (required), CloudFormation, ARM/Bicep, Helm — and IaC security scanning in CI/CD pipelines (GitHub Actions, GitLab CI, Jenkins, Azure DevOps)
• Strong working knowledge of cloud log analysis — AWS CloudTrail, GuardDuty, VPC Flow Logs; Azure Activity Log, Defender for Cloud, Entra ID sign-in logs; GCP Audit Logs, VPC Flow Logs, Security Command Center; Kubernetes audit logs; EKS / AKS / GKE control plane logs
• Working knowledge of cloud-native attack tradecraft mapped to MITRE ATT&CK Cloud Matrix — cloud credential theft, IMDS abuse, role chaining, container escape, Kubernetes RBAC abuse, S3 / blob storage exfiltration, supply-chain attacks on container images and IaC
• Hands-on scripting and query proficiency: Python, Bash, PowerShell, CQL (CrowdStrike Query Language); KQL a plus
• Experience building Falcon Fusion SOAR playbooks, Charlotte AI workflows, or equivalent automation content on the Falcon platform
• Prior consulting delivery experience — scoping, leading, and personally executing cloud security deployment engagements for external clients
• Bachelor's degree in a relevant field or equivalent professional experience
• CrowdStrike Certified Cloud Specialist (CCCS) certification — strongly preferred. Candidates without CCCS at hire will be expected to certify within their first 90 days
• Additional CrowdStrike credentials: CCFA, CCFR, CCSA, CCSE, CCIS
• Cloud-native security certifications (one or more strongly preferred): AWS Certified Security – Specialty, Microsoft Certified: Azure Security Engineer Associate (AZ-500), Google Cloud Professional Cloud Security Engineer, Certified Kubernetes Security Specialist (CKS), Certified Kubernetes Administrator (CKA)
• Foundational cloud certifications: AWS Solutions Architect (Associate or Professional), Azure Administrator / Solutions Architect Expert, Google Cloud Professional Cloud Architect
• Industry security certifications: CCSP (Certified Cloud Security Professional), CISSP, GCSA (GIAC Cloud Security Automation), GCLD (GIAC Cloud Security Essentials)
• Experience deploying and tuning Falcon Next-Gen SIEM / LogScale content for cloud detection engineering (parsers, correlation rules, dashboards, case management)
• Experience building production Falcon Fusion SOAR playbooks for cloud response at scale
• Experience building Charlotte AI prompts and agentic workflows for cloud security use cases
• Experience with competing CNAPPs (Wiz, Prisma Cloud, Lacework, Aqua, Sysdig, Orca) — particularly migration experience from those platforms to Falcon Cloud Security
• Hands-on with service mesh (Istio, Linkerd), secrets management (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager), and policy-as-code (OPA / Rego, Kyverno)
• Prior consulting experience at a tier-1 firm with a CrowdStrike-focused or cloud security delivery practice (Big 4 cloud security teams, CrowdStrike Services, Mandiant, Unit 42, or equivalent)
• Experience supporting cloud security M&A due diligence, post-acquisition cloud tenant consolidation, or cloud migration security