- Own CrowdStrike Falcon configuration, ensuring policies are appropriately scoped, tuned, and generating actionable alerts.
- Partner with MDR to define alert routing, triage thresholds, and escalation logic, ensuring the right signals reach the right team.
- Monitor cloud environments (primarily AWS) for security posture drift: misconfigured IAM roles, overly permissive security groups, exposed storage, and non-compliant resource configurations.
- Secure Kubernetes clusters and containerized workloads: manage Network Policies, RBAC, Admission Controllers, and runtime detection for anomalous container behavior.
- Develop and enforce cloud security policies and standards for AWS infrastructure, ensuring secure and scalable deployments align with organizational risk posture.
- Evaluate and lead the implementation of additional detection tooling, including cloud SIEM platforms, designing detection rules and alerting pipelines.
- Manage infrastructure as code (IaC) security using Terraform or OpenTofu — ensuring IaC definitions meet security standards before deployment.
- Automate security posture checks and detection workflows using Python and shell scripting.
- Stay current with the evolving cloud threat landscape and translate emerging threats into detection coverage or posture improvements.
AWSPythonKubernetes+1 more