Skip to content
NEXTMOVEFDE careers · United States
Kroll

Senior Manager, CrowdStrike Cloud Security, Cyber Engineered Defense

AI summary of the role

Player-coach role building and leading Kroll's CrowdStrike Falcon Cloud Security deployment practice.

What you’ll do

  • Lead end-to-end deployment of Falcon Cloud Security across client AWS, Azure, and GCP environments, including account onboarding, sensor deployment, and agentless scanning.
  • Configure CSPM, CWP, KSPM, CIEM, ASPM, and DSPM policies, including custom IOM/IOA detections and compliance frameworks.
  • Integrate cloud log telemetry into Falcon Next-Gen SIEM, build detection content, and create Fusion SOAR playbooks for cloud-native response.
  • Tune IOM/IOA policies and ExPRT.AI prioritization to reduce false positives while maintaining detection efficacy.

What you’ll bring

  • 5+ years (Manager) or 7+ years (Senior Manager) hands-on deploying/configuring/operating cloud security tooling, with meaningful CNAPP/CSPM/CWP/container/Kubernetes security concentration.
  • Hands-on deployment experience with CrowdStrike Falcon Cloud Security (CSPM, CWP, CIEM, KSPM, IaC scanning) required; equivalent competing CNAPP (Wiz, Prisma Cloud, Lacework, Aqua, Sysdig, Orca) plus ramp willingness acceptable.
  • Demonstrated deployment/config/integration experience across AWS, Azure, and GCP — working depth in at least two hyperscalers required.
  • Hands-on Kubernetes security (EKS, AKS, GKE, or self-managed) including Pod Security Standards, admission controllers, RBAC, container runtime protection.

Technologies

CrowdStrike Falcon · Falcon Cloud Security · CNAPP · CSPM · CWP · CIEM · KSPM · ASPM · DSPM · AWS · Azure · GCP

Source and classification

Implementation & delivery · Evidence for this classification:

At Kroll, we provide reactive, advisory, transformation, and managed security services to support clients at every stage of their path toward cyber and data resilience maturity. Our experts bring decades of experience in cyber risk consultancy, helping organizations across the world simplify and reduce the complexity of implementing, transforming, and managing their cyber programs. Through our strategic multi-year partnership with CrowdStrike, we combine world-class investigative expertise with an AI-native platform to redefine the future of managed detection and response, delivering faster outcomes, stronger protection, and greater resilience for organizations worldwide. The Cyber & Data Resilience capability is hiring a Manager or Senior Manager to build and lead Kroll's CrowdStrike Falcon Cloud Security deployment practice. Falcon Cloud Security is the industry's first unified
More from the job description

At Kroll, we provide reactive, advisory, transformation, and managed security services to support clients at every stage of their path toward cyber and data resilience maturity. Our experts bring decades of experience in cyber risk consultancy, helping organizations across the world simplify and reduce the complexity of implementing, transforming, and managing their cyber programs. Through our strategic multi-year partnership with CrowdStrike, we combine world-class investigative expertise with an AI-native platform to redefine the future of managed detection and response, delivering faster outcomes, stronger protection, and greater resilience for organizations worldwide. The Cyber & Data Resilience capability is hiring a Manager or Senior Manager to build and lead Kroll's CrowdStrike Falcon Cloud Security deployment practice. Falcon Cloud Security is the industry's first unified Cloud-Native Application Protection Platform (CNAPP), spanning CSPM, CWP, CIEM, KSPM, ASPM, DSPM, IaC scanning, and container and Kubernetes runtime protection across AWS, Azure, and Google Cloud — delivered through one sensor and one console, with both agent-based and agentless coverage. Kroll clients need a partner who can deploy, configure, integrate, and tune Falcon Cloud Security end-to-end inside their Falcon tenant — registering cloud accounts at scale across AWS Organizations, Azure tenants, [... source excerpt omitted ...] ion SOAR playbooks for cloud-native response; and tuning IOM (Indicators of Misconfiguration) and IOA (Indicators of Attack) policies to maximize signal and minimize noise in each client's cloud estate. This is a player-coach role. The “Manager” or “Senior Manager” title does not mean hands-off oversight. You will personally lead engagement delivery — onboarding cloud accounts, deploying sensors and admission controllers, configuring CNAPP modules, building detection content, and integrating with the broader Falcon stack — while mentoring junior consultants and partnering with CrowdStrike account teams on scoping. This role reports into the Engineered Defense / Tech Transform [... source excerpt omitted ...] ss EKS, AKS, GKE, and self-managed Kubernetes. Roll out container image registry scanning and IaC scanning (Terraform, CloudFormation, ARM/Bicep, Kubernetes manifests, Helm) into client CI/CD pipelines (GitHub Actions, GitLab CI, Jenkins, Azure DevOps). Enable serverless protection for AWS Lambda, Azure Functions, and GCP Cloud Functions. Stand up CIEM across cloud identity providers (IAM users, roles, service accounts, managed identities) for least-privilege analysis. Configure Configure CSPM policies — IOM rules, custom misconfiguration detections, compliance frameworks (CIS Benchmarks, NIST, PCI-DSS, HIPAA, SOC 2), and exception management. Configure CWP runtime polici

How jobs are selected

Employer postings · Data from · Sources