K

Kroll

Global risk management and investigations consulting

Senior Manager - Crowdstrike Cloud Security, Cyber Engineered Defense

Full-TimeUpdated on 10/21/2026
$150k - $200k+ Performance-based incentives
Senior
Bachelor's
Remote in USA
Remote
CybersecuritySecurity Engineering & Architecture

About the job

Requirements
  • At least 5 years of hands-on experience deploying, configuring, and operating enterprise cloud security tooling, with a meaningful concentration in CNAPP, CSPM, CWP, or container/Kubernetes security; candidates for Senior Manager are listed at 7+ years, though years are guidelines and CCCS certification plus demonstrable multi-hyperscaler Falcon Cloud Security deployment experience can offset tenure.
  • Hands-on CrowdStrike Falcon platform deployment experience is required, including Falcon Cloud Security; equivalent hands-on experience with a competing CNAPP and willingness to ramp on Falcon Cloud Security is acceptable.
  • Experience deploying, configuring, and integrating cloud security platforms across AWS, Azure, and GCP, with working depth in at least two hyperscalers.
  • Hands-on Kubernetes security experience, including EKS, AKS, GKE, or self-managed Kubernetes; Pod Security Standards; admission controllers; RBAC; and container runtime protection.
  • Hands-on Infrastructure as Code experience with Terraform, and familiarity with CloudFormation, ARM/Bicep, or Helm, plus IaC security scanning in CI/CD pipelines such as GitHub Actions, GitLab CI, Jenkins, or Azure DevOps.
  • Working knowledge of cloud log analysis, including AWS CloudTrail, GuardDuty, and VPC Flow Logs; Azure Activity Log, Defender for Cloud, and Entra ID sign-in logs; GCP Audit Logs, VPC Flow Logs, and Security Command Center; Kubernetes audit logs; and EKS, AKS, or GKE control plane logs.
  • Working knowledge of cloud-native attack tradecraft mapped to the MITRE ATT&CK Cloud Matrix, including cloud credential theft, IMDS abuse, role chaining, container escape, Kubernetes RBAC abuse, S3/blob storage exfiltration, and supply-chain attacks on container images and IaC.
  • Hands-on scripting and query proficiency in Python, Bash, PowerShell, and CQL; KQL is a plus.
  • Experience building Falcon Fusion SOAR playbooks, Charlotte AI workflows, or equivalent automation content on the Falcon platform.
  • Prior consulting delivery experience scoping, leading, and personally executing cloud security deployment engagements for external clients.
  • Bachelor’s degree in a relevant field or equivalent professional experience.
Responsibilities
  • Onboard client AWS, Azure, and GCP environments to Falcon Cloud Security at scale using CloudFormation StackSets across AWS Organizations, Bicep and Entra ID integrations for Azure tenants and management groups, and service account patterns for GCP projects and folders.
  • Deploy the Falcon sensor across EC2, Azure VMs, GCE instances, container hosts, and Kubernetes nodes, and deploy agentless snapshot-based scanning to fill coverage gaps.
  • Deploy the Kubernetes Admission Controller across EKS, AKS, GKE, and self-managed Kubernetes to enforce pre-runtime workload-admission policy.
  • Roll out container image registry scanning and IaC scanning for Terraform, CloudFormation, ARM/Bicep, Kubernetes manifests, and Helm in client CI/CD pipelines.
  • Enable serverless protection for AWS Lambda, Azure Functions, and GCP Cloud Functions.
  • Establish CIEM across cloud identity providers, including IAM users, roles, service accounts, and managed identities, for least-privilege analysis.
  • Configure CSPM policies, including IOM rules, custom misconfiguration detections, compliance frameworks, and exception management.
  • Configure CWP runtime policies, including IOA detections, prevention policies, container runtime protection, and drift detection.
  • Configure KSPM policies for Kubernetes posture, pod security standards, admission control rules, and RBAC analysis.
  • Configure ASPM and DSPM policies for application-security and data-security posture across cloud data stores.
  • Configure CIEM for effective permission analysis, toxic combinations, privilege right-sizing, and service-account hygiene.
  • Configure ExPRT.AI risk prioritization to surface attack paths and toxic combinations across CSPM, CWP, and CIEM signals.
  • Build and tune custom detection content, including IOAs, IOMs, and CQL queries, for cloud-native attack techniques mapped to the MITRE ATT&CK Cloud Matrix.
  • Ingest cloud log telemetry into Falcon Next-Gen SIEM/LogScale, including cloud-provider audit and network logs, security findings, identity sign-in logs, and Kubernetes control-plane and audit logs.
  • Build detection-engineering content in Next-Gen SIEM that correlates Falcon Cloud Security findings with cloud-provider logs, endpoint telemetry, and identity events for attack-path visibility.
  • Build Falcon Fusion SOAR playbooks for cloud-native response, including quarantining compromised workloads, revoking IAM credentials, isolating Kubernetes pods, remediating misconfigurations through IaC pull requests, and triggering MFA through Falcon Identity Protection.
  • Integrate Falcon Cloud Security with Falcon Identity Protection for cross-domain correlation of cloud workload activity and identity risk.
  • Integrate Falcon Cloud Security with Falcon Insight (EDR) for unified endpoint and cloud workload protection.
  • Integrate Falcon Cloud Security with Falcon AIDR for AI workload runtime protection in Kubernetes.
  • Build Charlotte AI prompts and agentic workflows for cloud event triage, misconfiguration remediation guidance, and executive cloud-risk reporting.
  • Tune IOM and IOA policies to reduce false positives without sacrificing detection efficacy.
  • Tune ExPRT.AI prioritization and attack-path analysis to client risk tolerance and remediation capacity.
  • Optimize sensor performance and agentless scan cadence to balance cost and coverage.
  • Validate detection coverage through controlled adversary emulation against the MITRE ATT&CK Cloud Matrix.
  • Hand off operational runbooks to client cloud security teams and Kroll Managed Services for ongoing operation.
  • Advise client cloud platform, DevSecOps, and SOC engineering teams on Falcon Cloud Security deployment architecture, including agent-versus-agentless coverage decisions, account onboarding patterns, Kubernetes admission-control posture, IaC scanning policy in CI/CD, and integration with existing Falcon modules.
  • Partner with CrowdStrike account teams on Falcon Cloud Security pre-sales scoping, solution design, proof-of-value engagements, and joint go-to-market motions.
  • Develop reusable Falcon Cloud Security deployment runbooks, Terraform and Bicep configuration templates, integration patterns, Fusion SOAR playbook libraries, custom IOM/IOA detection libraries, and Charlotte AI workflow templates.
  • Mentor consultants on Falcon Cloud Security deployment and integration.
Desired Qualifications
  • CrowdStrike Certified Cloud Specialist (CCCS) certification is strongly preferred; candidates without CCCS at hire are expected to certify within their first 90 days.
  • Additional CrowdStrike credentials, including CCFA, CCFR, CCSA, CCSE, or CCIS.
  • One or more cloud-native security certifications, such as AWS Certified Security – Specialty, Microsoft Certified: Azure Security Engineer Associate (AZ-500), Google Cloud Professional Cloud Security Engineer, Certified Kubernetes Security Specialist (CKS), or Certified Kubernetes Administrator (CKA).
  • Foundational cloud certifications, such as AWS Solutions Architect Associate or Professional, Azure Administrator or Solutions Architect Expert, or Google Cloud Professional Cloud Architect.
  • Industry security certifications, such as CCSP, CISSP, GCSA, or GCLD.
  • Experience deploying and tuning Falcon Next-Gen SIEM/LogScale content for cloud detection engineering, including parsers, correlation rules, dashboards, and case management.
  • Experience building production Falcon Fusion SOAR playbooks for cloud response at scale.
  • Experience building Charlotte AI prompts and agentic workflows for cloud security use cases.
  • Experience with competing CNAPPs, particularly migration from those platforms to Falcon Cloud Security.
  • Hands-on experience with service mesh technologies such as Istio or Linkerd, secrets management tools such as HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, or GCP Secret Manager, and policy-as-code tools such as OPA/Rego or Kyverno.
  • Prior consulting experience at a tier-1 firm with a CrowdStrike-focused or cloud security delivery practice, such as Big 4 cloud security teams, CrowdStrike Services, Mandiant, or Unit 42.
  • Experience supporting cloud security M&A due diligence, post-acquisition cloud tenant consolidation, or cloud migration security.

About the company

K

Kroll

View
Website

Preparing summary

Company Size

5,001-10,000

Company Stage

N/A

Total Funding

N/A

Headquarters

New York City, New York

Founded

1932

Get referred to Kroll

See people who can refer or advise you

Simplify Jobs

Simplify's Take

What believers are saying

  • Kroll launched APEX on August 31, 2026, targeting CFOs spending on AI cyber automation.
  • Kroll acquired ABC economics in July 2026, deepening European cartel and damages expertise.
  • Kroll expanded South Africa restructuring on June 2, 2026, adding three senior leaders.

What critics are saying

  • FTX and BlockFi data-breach claims against Kroll Restructuring Administration face arbitration through October 2026.
  • A September 23, 2026 scheduling order keeps Kroll in a DTSA trade-secret suit.
  • Kroll Restructuring Administration’s 2023 breach litigation threatens bankruptcy-client trust and future appointments.

What makes Kroll unique

  • Kroll spans investigations, restructuring, valuation, and cyber, letting clients buy one advisor globally.
  • Fred Crawford became Executive Chairman on May 18, 2026, strengthening professional-services scaling discipline.
  • APEX embeds Kroll’s advisory methods inside CrowdStrike Falcon, tying strategy directly to execution.

Help us improve and share your feedback! Did you find this helpful?

Benefits

  • Hybrid Work Options

Growth & Insights and Company News

Headcount

6 month growth

17%

1 year growth

17%

2 year growth

17%
Green Street News
Sep 16th, 2026
Patrizia accelerates Middle East expansion with senior hire.

Patrizia accelerates Middle East expansion with senior hire. Hassan Awada joins from Kroll Want to read the full article? You must be a subscriber to its UK/Europe news coverage to read this article.

PR Newswire
Aug 31st, 2026
Kroll introduces APEX to drive measurable business outcomes from AI investment.

Kroll introduces APEX to drive measurable business outcomes from AI investment. Aug 31, 2026, 10:00 ET NEW YORK and LAS VEGAS, Aug. 31, 2026 /PRNewswire/ - Fal.Con 2026 - Kroll, the leading independent provider of global financial and risk advisory solutions, today announced the launch of Kroll AI Automation Prioritization EXecution (APEX). A new capability developed on the CrowdStrike Falcon(R) platform, Kroll APEX enables organizations to make more informed cyber investment decisions by quantifying the expected operational effort, cost and business value of AI, automation and hybrid approaches. AI represents a significant and growing investment for organizations, yet many lack clear, measurable outcomes for CFOs to evaluate return on investment. "Worldwide spending on AI is forecast to total $2.59 trillion in 2026, a 47% increase year-over-year," according to Gartner, Inc.[1] Kroll APEX, built with Charlotte AI AgentWorks and Falcon Foundry, provides a data-driven decision framework that identifies, prioritizes and evaluates cyber use cases, enabling organizations to determine where AI, automation or a combination of both is most appropriate, before engineering work begins. Kroll works with clients to assess their cyber environment, organizational priorities and operational data through a structured discovery process. Using Kroll's experience across thousands of cyber engagements, alongside client-specific financial and operational inputs, APEX identifies and prioritizes opportunities, estimates implementation effort and expected returns and presents these insights through an intuitive dashboard embedded within the Falcon platform. Clients can use the capability as a strategic assessment or as part of an ongoing advisory engagement, continually refining cyber priorities as their organizations evolve. The result is greater confidence in cyber investment decisions and stronger alignment between security strategy and business objectives. By providing finance and security leaders with a shared view of investment priorities and expected outcomes, APEX helps organizations optimize technology spending, accelerate decision-making and build more resilient cyber programs. "Kroll APEX changes the conversation from 'Should we invest in AI?' to 'Where will AI, automation or human expertise deliver the greatest value?'," said Dave Burg, Global Group Head of Cyber and Data Resilience at Kroll. "With cyber risks mounting and spending accelerating, CFOs and CISOs are under growing pressure to bring financial discipline and operational insight together to make more informed cyber investment decisions. Boards are calling for greater clarity around these decisions, and Kroll provides the insight to prioritize initiatives based on measurable business outcomes rather than guesswork." Kroll APEX reflects the continued evolution of the strategic relationship between Kroll and CrowdStrike, expanding on Kroll's role as a founding member of CrowdStrike's Charlotte AI AgentWorks Ecosystem and Project QuiltWorks. By combining CrowdStrike's AI-native cybersecurity platform with Kroll's advisory expertise, implementation experience and proprietary methodologies, the collaboration enables organizations to make evidence-based decisions that align security investment with broader business priorities. "AI is redefining what's possible in cybersecurity, but value comes from applying it where it can have the greatest impact," said Daniel Bernard, Chief Business Officer at CrowdStrike. "Kroll is combining its deep advisory expertise with the power of Falcon to help customers turn AI ambition into measurable business outcomes. APEX is a great example of how our partners are building on CrowdStrike to drive innovation and deliver more value for customers." To discover how Kroll and CrowdStrike can help your organization maximize the value of its cyber investments, visit kroll.com/crowdstrike. About Kroll As the leading independent provider of financial and risk advisory solutions, Kroll leverages our unique insights, data and technology to help clients stay ahead of complex valuation demands. Kroll's team of more than 6,500 professionals worldwide continues the firm's nearly 100-year history of trusted expertise spanning risk, governance, transactions and valuation. Our advanced solutions and intelligence provide clients the foresight they need to create an enduring competitive advantage. At Kroll, our values define who we are and how we partner with clients and communities. Learn more at kroll.com. [1] Gartner Press Release, "Gartner Forecasts Worldwide AI Spending to Grow 47 Percent in 2026," 19 May 2026. https://www.gartner.com/en/newsroom/press-releases/2026-05-19-gartner-forecasts-worldwide-ai-spending-to-grow-47-percent-in-2026. GARTNER is a trademark of Gartner, Inc. and/or its affiliates SOURCE Kroll

PR Newswire
Aug 31st, 2026
Kroll launches APEX to help firms measure ROI on $2.59T AI spending

Kroll has launched APEX, a capability built on CrowdStrike's Falcon platform that helps organisations evaluate the return on investment from AI and automation in cybersecurity. The tool provides a data-driven framework to identify and prioritise cyber use cases, estimating implementation effort and expected returns before engineering work begins. APEX addresses growing pressure on CFOs and CISOs to justify cyber spending. According to Gartner, worldwide AI spending is forecast to reach $2.59 trillion in 2026, up 47% year-over-year. The capability uses Kroll's experience from thousands of cyber engagements alongside client-specific data to recommend where AI, automation, or human expertise will deliver the greatest value. Results are presented through a dashboard embedded within the Falcon platform. Dave Burg, Kroll's Global Group Head of Cyber and Data Resilience, said APEX brings financial discipline and operational insight together to support more informed investment decisions based on measurable business outcomes.

Consultancy.com.au
Aug 9th, 2026
Cybersecurity veterans launch new Melbourne consultancy MosaicalAI.

Cybersecurity veterans launch new Melbourne consultancy MosaicalAI. 09 August 2026 Consultancy.com.au Former Tesserent senior partner Mark Jones has launched a new AI consultancy in Melbourne alongside fellow cybersecurity expert Alexandre Medarov, which the pair have dubbed MosaicalAI. The motivation behind the launch of MosaicalAI is to support organisations in forging ahead with AI while ensuring the appropriate back-stops are still in place, with its services grouped around leadership coaching, design, build, security, and governance. Together the pair bring over five decades of combined industry experience to their new venture, with Jones most recently working as a director at Thales following its ~$175 million Tesserent acquisition and Medarov leading another AI start-up, dig8italX. "Move too slow and lose the market; move too fast and risk the business," goes the company pitch, with Jones stating; "We started MosaicalAI to help Australian businesses move quickly with AI, but without losing visibility, accountability or control. The AI opportunity is huge, but it needs to be done with the right people, workflows, and governance placed around it." Prior to his five years between Tesserent and Thales (which just sold off its local managed cloud services business to Interactive), Jones served as deputy CISO at Medibank, before which he was A/NZ cyber risk leader at Kroll and spent time in senior roles at a number of energy and financial services firms including Jemena and ANZ in a career dating back to Deloitte in 1998. Medarov meanwhile started his career with a stint at Accenturein Germany, and has since 2006 spent time at Dell EMC, both the University of Auckland and Monash, and in a senior cybersecurity role at Allianz back in Munich, where he had led the locally-based AI security consultancy dig8ital and its off-shoot as CISO and managing director since 2017 but most recently out of London. Now the pair have put their expertise and brains together to form MosaicalAI in Melbourne, which takes its name from the 'mosaic' of, brace yourselves, an AI operating layer "comprised of the tools, portals, reports, and decision surfaces a customer's team uses", including "agents, workflow logic, hand-offs, fallback paths, approvals, and routing and system actions," among other stuff. "Our view is that AI needs to be built with the same discipline that cyber has learned the hard way as to visibility, governance, accountability and clear ownership," Jones says. "There's a lot of noise around AI right now, but for executives, leaders and teams, I think it comes down to two fears: people are not ready, and businesses do not have the right team to build bespoke AI capability." That is where MosaicalAI comes in, the start-up says; "Our work is practical and hands on. We help clients engage their people, build AI into their business, and govern it from day one. We are already working with mid- and upper-middle market firms, and want to help them move at AI speed without creating the technical debt, governance mess, or loss of control that comes from rushing in blindly."

Insolvency Insider
Jul 31st, 2026
Moves and promotions - week of 27 july, 2026.

Moves and promotions - week of 27 july, 2026. Helen Bates has joined Brabners in Leeds as an Insolvency & Restructuring Partner. Helen was previously with Freeths. Read more. Graeme Bain has been promoted to Partner and Head of Restructuring at Johnston Carmichael. Read more. Stuart Deacon and Jonathan Thielmann have joined Kroll in London as Managing Directors. Stuart was previously with A&M, while Jonathan was previously with Interpath. Read more.