CrowdStrike Identity Security Architect

Project overview

Costello & Reyes Group Ltd have been engaged by its Client, a global SI to identify a Crowdstrike Identity Security Architect for an initial 6 month engagement.

We are seeking a highly experienced CrowdStrike Identity Security Architect to support the design, implementation, configuration, optimisation and operational integration of CrowdStrike's identity security capabilities within a complex enterprise environment.

The successful candidate will bring demonstrable, hands-on expertise in CrowdStrike Falcon Identity Protection, alongside a strong understanding of identity threat detection and response (ITDR), hybrid identity architectures, Active Directory (AD), Microsoft Entra ID, privileged access management (PAM), and modern identity-centric cyber threats.

This is a senior technical architecture and engineering role requiring an individual who can operate at both strategic and hands-on implementation levels, translating security requirements into robust, scalable and operationally effective identity protection capabilities.

The engagement will focus on strengthening the organisation's ability to identify, detect, investigate and respond to identity-based attacks, including credential compromise, privilege escalation, lateral movement, identity misuse and attacks targeting hybrid Microsoft identity environments.

The successful candidate will be expected to work closely with Security Architecture, Identity and Access Management (IAM), Security Operations (SOC), Infrastructure and relevant third-party technology providers.

This is not a purely advisory or governance-focused role. Candidates must demonstrate substantial practical experience implementing, configuring and optimising CrowdStrike Identity Protection in enterprise environments.

The principal objectives of the engagement are to:

Architect, implement and optimise CrowdStrike Falcon Identity Protection across the organisation's identity infrastructure.

Establish comprehensive visibility of identity-based threats, attack paths and associated security exposures.

Strengthen protection of Active Directory, Microsoft Entra ID and hybrid identity environments.

Identify and mitigate risks associated with compromised credentials, privileged accounts, excessive permissions and identity misconfigurations.

Integrate identity threat intelligence, detection and response capabilities with existing security tooling and SOC processes.

Configure appropriate identity protection policies, risk-based controls, detections and response workflows.

Improve identity security posture through continuous assessment, monitoring and remediation.

Establish sustainable operational procedures, documentation, knowledge transfer and ongoing assurance.

3.1 CrowdStrike Identity Security Architecture

Lead the technical design and implementation of CrowdStrike Falcon Identity Protection within the enterprise security architecture.

Assess the existing identity security environment, identifying architectural weaknesses, coverage gaps and opportunities for improvement.

Develop target-state identity security architecture aligned with organisational security requirements and recognised industry best practice.

Design and validate appropriate deployment architecture, identity visibility, telemetry collection, integration dependencies and protection coverage.

Define security policies and configurations to support identity threat detection, risk assessment and response.

Ensure that CrowdStrike Identity Protection is appropriately integrated with the broader CrowdStrike Falcon platform and existing enterprise security capabilities.

Produce architecture diagrams, technical design documentation, implementation plans and operational standards.

3.2 CrowdStrike Falcon Identity Protection - Implementation and Optimisation

This represents the primary technical focus of the engagement.

Undertake hands-on configuration, deployment, validation and optimisation of CrowdStrike Falcon Identity Protection.

Configure identity-related detections, risk policies, monitoring capabilities and supported response actions.

Establish appropriate visibility of authentication activity, privileged identities, identity exposures and suspicious identity behaviour.

Analyse identity-related detections and determine appropriate tuning, prioritisation and remediation.

Identify and investigate compromised credentials, suspicious authentication activity, account misuse and privilege escalation.

Assess identity attack paths and prioritise remediation based on exploitability, business impact and associated risk.

Configure supported risk-based identity protection controls, ensuring appropriate testing and operational safeguards.

Optimise detection quality, reduce unnecessary alerts and improve actionable visibility for security operations.

Validate integration and telemetry coverage across applicable identity systems.

Establish appropriate configuration management, change control, testing and rollback arrangements.

Candidates must understand the capabilities, dependencies and limitations of CrowdStrike Identity Protection and be able to distinguish between native functionality, licensed capabilities and requirements for complementary IAM, PAM or Microsoft security controls.

3.3 Active Directory and Microsoft Entra ID Security

Conduct technical assessments of on-premises Active Directory and Microsoft Entra ID environments.

Review authentication mechanisms, trust relationships, administrative privileges and identity-related security configurations.

Identify weaknesses associated with Kerberos, NTLM, LDAP, directory permissions and privileged authentication.

Assess hybrid identity attack paths involving on-premises and cloud identity infrastructure.

Review Microsoft Entra Connect/Cloud Sync configurations and associated security dependencies where applicable.

Identify risks associated with excessive privileges, Legacy authentication, service accounts and insecure identity configurations.

Recommend and support remediation of identity exposures and misconfigurations.

Collaborate with Microsoft infrastructure and IAM teams to implement appropriate preventive and detective controls.

3.4 Identity Threat Detection and Response (ITDR)

Design and implement an effective identity threat detection and response capability using CrowdStrike.

Develop detection and response use cases addressing identity-focused attack techniques.

Investigate suspicious authentication activity, credential theft, account compromise, privilege escalation and lateral movement.

Validate detection capabilities against recognised adversary techniques and MITRE ATT&CK.

Support the development of identity-focused threat-hunting scenarios and investigation procedures.

Define incident triage, investigation, containment and escalation workflows.

Establish operational playbooks for identity compromise scenarios, including privileged account compromise.

Collaborate with SOC and incident response teams to improve detection accuracy and response effectiveness.

Support controlled testing of identity protection capabilities and relevant response actions.

3.5 Privileged Identity and Access Security

Assess privileged account exposure across Active Directory, Entra ID and relevant enterprise systems.

Identify excessive permissions, privilege escalation paths and inappropriate administrative access.

Review security controls associated with domain administrators, enterprise administrators, service accounts and other high-value identities.

Evaluate privileged identity attack paths and associated mitigation opportunities.

Support integration and alignment with existing PAM technologies, where applicable.

Provide recommendations for privileged access hardening, least privilege and identity segmentation.

Ensure that identity protection controls complement, rather than duplicate or conflict with, established PAM and IAM capabilities.

3.6 Security Integration and Automation

Integrate CrowdStrike identity security capabilities with relevant SOC, SIEM, SOAR and incident management platforms.

Support integration with other CrowdStrike Falcon modules, subject to deployed capabilities and licensing.

Design and implement supported API-based integrations and automation workflows.

Develop scripts and automation to support configuration, reporting, investigation and operational efficiency.

Ensure identity-related alerts and events are appropriately prioritised, enriched and routed for investigation.

Support the development of automated or analyst-approved response workflows, with appropriate controls for high-impact actions.

Collaborate with platform engineering and security operations teams to ensure reliable end-to-end integration.

3.7 Security Posture Management and Risk Reduction

Assess the organisation's current identity security posture and identify material risks.

Develop a prioritised remediation roadmap addressing identity exposures, attack paths and control deficiencies.

Establish meaningful metrics to measure identity protection coverage, detection effectiveness and remediation progress.

Provide technical input into security risk assessments and architectural reviews.

Align relevant security controls with recognised frameworks, including ISO/IEC 27001:2022, NIST CSF 2.0 and MITRE ATT&CK.

Support continuous improvement through regular technical assessments, configuration reviews and control validation.

3.8 Documentation, Governance and Knowledge Transfer

Produce and maintain detailed technical architecture and implementation documentation.

Document platform configurations, security policies, integrations and operational dependencies.

Develop SOC playbooks, investigation procedures and response guidance.

Maintain a record of identified risks, remediation recommendations and technical decisions.

Provide regular progress updates, highlighting key risks, dependencies and implementation challenges.

Deliver knowledge transfer and technical workshops to internal engineering, IAM and SOC teams.

Support formal operational handover and acceptance of the implemented solution.

4.1 CrowdStrike Identity Protection - Mandatory

Candidates must demonstrate:

Significant hands-on experience with CrowdStrike Falcon Identity Protection in enterprise environments.

Proven experience designing and implementing CrowdStrike identity security solutions.

Practical experience configuring identity detection policies, identity risk assessments and supported protection or response controls.

Strong understanding of CrowdStrike identity-related telemetry, detections, investigations and remediation workflows.

Experience identifying and addressing identity attack paths and security exposures.

Experience integrating CrowdStrike identity capabilities into wider enterprise security operations.

Demonstrable experience troubleshooting deployment, integration, policy and operational issues.

Understanding of CrowdStrike Falcon platform architecture, relevant licensing dependencies and available integration capabilities.

Candidates whose CrowdStrike experience is limited to Falcon Prevent, Falcon Insight XDR or endpoint detection and response (EDR), without meaningful Falcon Identity Protection experience, will not meet the core technical requirement.

4.2 Identity and Microsoft Security - Mandatory

Expert knowledge of Microsoft Active Directory architecture, administration and security.

Strong practical experience securing Microsoft Entra ID and hybrid identity environments.

Detailed understanding of Kerberos, NTLM, LDAP, authentication protocols and Active Directory attack techniques.

Experience identifying and remediating privileged identity exposures and excessive permissions.

Strong understanding of credential theft, account takeover, privilege escalation and lateral movement.

Experience assessing identity trust relationships, authentication flows and directory configurations.

Knowledge of identity security hardening, least privilege and Zero Trust principles.

4.3 Security Architecture and Engineering - Mandatory

Proven experience operating as a Senior Security Architect, Identity Security Architect or equivalent technical SME.

Strong understanding of enterprise security architecture and integration patterns.

Experience delivering security technology implementations in complex enterprise environments.

Ability to develop high-level and low-level technical designs.

Experience translating security risks and requirements into practical technical controls.

Strong troubleshooting, problem-solving and technical assurance capabilities.

Experience working collaboratively with IAM, infrastructure, security engineering and SOC teams.

4.4 Threat Detection and Response - Mandatory

Strong understanding of identity threat detection and response principles.

Experience investigating identity-related security incidents.

Knowledge of common identity attack techniques and adversary behaviours.

Familiarity with MITRE ATT&CK, particularly credential access, persistence, privilege escalation and lateral movement.

Experience developing detection use cases, investigation procedures and operational response playbooks.

Understanding of SIEM/SOAR integration and security event management.

The following would be advantageous:

Experience with CrowdStrike Falcon Insight XDR, Falcon Prevent, Falcon Fusion SOAR, Falcon Next-Gen SIEM or other relevant Falcon capabilities.

Experience with CrowdStrike identity-related exposure assessment and attack-path analysis.

Knowledge of Microsoft Defender for Identity, Microsoft Sentinel and Microsoft Defender XDR.

Experience with CyberArk, Delinea, BeyondTrust or other PAM platforms.

Familiarity with SailPoint, Saviynt or equivalent identity governance solutions.

Experience with Microsoft Entra ID Protection, Conditional Access and Privileged Identity Management.

Experience developing automation using PowerShell, Python and REST APIs.

Knowledge of hybrid cloud security architectures, including Azure and AWS identity security.

Experience supporting Purple Team exercises or identity-focused adversary simulation.

Experience within financial services, regulated enterprises or other security-sensitive environments.

Relevant professional certifications, such as CISSP, CCSP, Microsoft identity/security certifications or applicable CrowdStrike accreditations.

The successful candidate will be expected to deliver tangible technical and operational improvements throughout the engagement.

Month 1 - Discovery, Assessment and Architecture

Review existing identity architecture, security controls and CrowdStrike deployment.

Assess current CrowdStrike Identity Protection configuration, licensing and coverage.

Identify identity security gaps, technical dependencies and implementation constraints.

Conduct initial identity exposure and attack-path assessments.

Produce a current-state assessment and prioritised findings.

Develop an agreed target-state architecture and implementation roadmap.

Deliverables: Current-state assessment, identity security gap analysis, target-state architecture and prioritised implementation plan.

Month 2 - Core Platform Configuration and Implementation

Implement or optimise CrowdStrike Falcon Identity Protection.

Validate relevant identity telemetry and monitoring coverage.

Configure initial identity risk policies, detections and supported response controls.

Establish required integrations with Active Directory, Entra ID and relevant security platforms.

Test and validate platform functionality.

Deliverables: Configured platform, initial detection policies, integration documentation and implementation validation results.

Month 3 - Identity Threat Detection and Protection Optimisation

Expand identity threat detection and investigation use cases.

Assess privileged identity risks and hybrid identity attack paths.

Tune detection policies and improve alert quality.

Implement agreed identity risk reduction measures.

Validate security controls against representative identity attack scenarios.

Deliverables: Optimised detection policies, identity attack-path findings, remediation tracker and technical validation evidence.

Month 4 - SOC Integration and Operationalisation

Integrate identity security monitoring into established SOC processes.

Develop identity incident investigation and response playbooks.

Implement agreed alert enrichment, workflow and automation capabilities.

Validate escalation and containment procedures.

Conduct operational testing with relevant security teams.

Deliverables: SOC integration documentation, operational playbooks, tested response workflows and initial operational metrics.

Month 5 - Security Assurance and Continuous Improvement

Conduct detailed configuration and detection effectiveness reviews.

Validate identity security coverage and identify residual gaps.

Undertake targeted attack simulation or Purple Team validation where authorised.

Refine detection, investigation and response capabilities.

Develop longer-term recommendations for identity security maturity.

Deliverables: Security assurance findings, updated risk register, control effectiveness assessment and improvement roadmap.

Month 6 - Final Optimisation, Handover and Knowledge Transfer

Complete outstanding implementation and optimisation activities.

Validate the operational effectiveness of the deployed solution.

Finalise technical architecture and configuration documentation.

Deliver knowledge transfer and operational training.

Establish ongoing monitoring, governance and continuous improvement arrangements.

Complete formal handover to internal security and IAM teams.

Deliverables: Final technical documentation, operational runbooks, knowledge transfer, residual risk register and formal handover report.

The precise sequencing and scope of deliverables will be agreed following the initial discovery phase, taking account of the existing CrowdStrike deployment, licensed capabilities and operational priorities.

The ideal candidate will have:

Extensive experience in enterprise cybersecurity architecture and engineering.

A strong specialist background in identity security, identity threat detection and Active Directory protection.

Demonstrable recent experience delivering CrowdStrike Falcon Identity Protection implementations or substantial optimisation engagements.

Experience working in complex hybrid Microsoft environments.

A proven ability to operate independently as a senior technical consultant.

Experience engaging with security leadership, architects, engineering teams and operational stakeholders.

A strong delivery focus, with the ability to take ownership of technical outcomes.

Previous experience delivering identity security transformation or ITDR programmes within large or regulated organisations would be particularly advantageous.

Technical Leadership: Ability to lead architecture and engineering decisions and provide authoritative technical guidance.

Hands-on Delivery: Comfortable undertaking detailed platform configuration, integration, troubleshooting and technical validation.

Analytical Capability: Strong ability to investigate complex identity security issues, identify root causes and develop practical remediation strategies.

Stakeholder Engagement: Ability to communicate complex technical findings clearly to both technical and non-technical stakeholders.

Risk-Based Approach: Capable of prioritising security improvements based on threat exposure, business criticality and operational impact.

Collaboration: Able to work effectively across security engineering, IAM, SOC, infrastructure and third-party teams.

Documentation: Ability to produce high-quality architecture documentation, technical procedures and operational handover material.

This is a six-month hybrid contract engagement, combining remote delivery with onsite attendance as required.

The successful candidate will be expected to attend onsite workshops, technical design sessions, implementation activities and stakeholder meetings as appropriate.

The specific onsite working pattern, location and travel expectations will be agreed with the client.

The role requires a consultant who can work autonomously while maintaining close engagement with the wider technical and security teams.

Given the specialist nature of this engagement, preference will be given to candidates who can provide clear examples of:

Important: General CrowdStrike EDR/XDR experience, while valuable, is not a substitute for direct CrowdStrike Identity Protection expertise. Candidates must be able to demonstrate practical delivery experience with the identity-specific capabilities of the platform.

At the conclusion of the six-month engagement, the organisation should have a demonstrably improved identity security capability, with CrowdStrike Falcon Identity Protection appropriately architected, configured, integrated and operationalised.

The engagement should deliver improved visibility of identity-based threats, stronger detection and response capabilities, reduced exposure to credential compromise and privilege escalation, and a sustainable operational model supported by documented procedures and trained internal teams.

The successful candidate will be instrumental in ensuring that the organisation realises the security and operational benefits of its investment in CrowdStrike Identity Protection.

This is an immediate need, should you be interested and have the relevant experience, please submit your profile and contact for further information.

• Role Overview
• Key Objectives
• Key Responsibilities
• Essential Technical Skills and Experience
• Desirable Technical Skills
• Key Deliverables
• Six-Month Engagement
• Experience and Professional Background
• Key Competencies
• Working Arrangements
• Candidate Selection
• Critical Requirements
• CrowdStrike Falcon Identity Protection: Direct hands-on deployment, configuration, integration and optimisation experience.
• Identity Security Architecture: Designing security controls for complex Active Directory and Microsoft Entra ID environments.
• Identity Threat Detection and Response: Implementing and tuning identity-focused detections, investigations and response processes.
• Privileged Identity Protection: Identifying and mitigating privilege escalation, credential compromise and lateral movement risks.
• Enterprise Implementation: Successfully delivering CrowdStrike identity security capabilities into production, including operational handover.
• Expected Outcome

Project details

• Start: ASAP
• Duration: 6 months initially
• Location: Home & site (once a month), UK, GB
• Rate: 75-75 EUR/h