Senior Cybersecurity Incident Handler (CrowdStrike)

Location: Hybrid role based in Austin, Texas or Warren, Michigan, with reporting to the assigned location at least 3 times per week.

Company

hirify.global develops automotive products and technologies guided by a vision of zero crashes, zero emissions, and zero congestion.

What you will do

• Triage, investigate, scope, and document cyber security incidents involving endpoints, identities, malware, suspicious processes, persistence, network activity, and potential data exposure.
• Develop investigative plans, collect and preserve evidence, analyze endpoint telemetry and live-response results, and determine root causes and lessons learned.
• Coordinate containment, eradication, remediation, and recovery actions such as host isolation, live response, file operations, directory cleanup, and scheduled-task removal.
• Use CrowdStrike Falcon, Next-Gen SIEM, live-response tooling, IT Automation, and related security platforms to investigate and respond to incidents.
• Improve detection coverage, threat hunting, correlation rules, playbooks, workflows, dashboards, integrations, and operational documentation.
• Coordinate with Response, Detect, Endpoint, Engineering, Insider Threat, Threat Intelligence, and other stakeholders while communicating risk, scope, severity, and status.

Requirements

• Experience with incident triage, scoping, evidence collection, endpoint investigation, containment, remediation, and operational recovery.
• Experience designing and deploying Windows live-response workflows, including multi-host execution, timeout handling, YARA scanning, file retrieval, and file removal.
• Strong CrowdStrike Falcon administration and engineering experience across Fusion Workflows, IT Automation, Next-Gen SIEM, custom IOA rules, lookup files, detections, APIs, and endpoint response.
• Python development experience for security exports, command-line utilities, API integrations, data transformation, and operational services.
• Experience with GitHub repository design, pull-request delivery, GitHub Actions, GitHub Pages, CI/CD, Terraform, GitOps, and multi-environment deployments.
• GM does not provide immigration-related sponsorship; candidates must already have appropriate authorization to work in the United States.

Nice to have

• Experience with Velociraptor or comparable endpoint live-response platforms, YARA, endpoint telemetry, host artifacts, and forensic collection.
• Experience integrating MISP, CrowdStrike, Slack, Confluence, GitHub, Sguil, Databricks, or comparable enterprise security platforms.
• Experience in regulated or highly governed enterprise environments and with open-source security or infrastructure tooling.
• Experience migrating wiki content and designing secure automation with role-based access, audit trails, approval controls, and rollback procedures.

Culture & Benefits

• Work as part of a broad Security Operations organization with cross-functional collaboration and knowledge sharing.
• Benefits and total rewards designed to support employee well-being at work and at home.
• Relocation benefits are available for candidates who qualify under company policy.
• Inclusive workplace focused on belonging, equal opportunity, and meaningful impact.

Hiring process

• Applicants may be required to complete role-related assessments and pre-employment screening where applicable.