Dragonfli Group is a cybersecurity and IT consulting firm providing services to federal agencies and Fortune 100 enterprises. Headquartered in Washington, DC, Dragonfli supports clients in securing mission-critical systems across on-site, hybrid, and fully remote environments.

We are seeking a highly experienced CrowdStrike ITDR / Cloud Security Subject Matter Expert to take full ownership of the Identity Threat Detection & Response (ITDR) and Cloud-Native Application Protection (CNAPP/CSPM) domains on behalf of a large federal agency. This is an ownership-oriented role — not a support function. You will serve as the definitive technical authority for CrowdStrike Falcon Identity Protection and Cloud Security, proactively identifying threats and misconfigurations, leading governance and stakeholder communications, and driving continuous improvements to the agency's identity and cloud security posture. The right candidate brings 7 or more years of cybersecurity experience, including at least 2–3 years of hands-on CrowdStrike Falcon platform administration, and thrives in environments where autonomy and accountability go hand in hand. This role is fully remote.

This is a multi-year contract position involving a large US federal agency. Candidates with previous federal contracting experience are preferred. U.S. Citizenship or Permanent Residency is required. If hired, all work related to this role must be performed within the continental U.S.

Responsibilities:

Own end-to-end strategy, implementation, and operational health of CrowdStrike Falcon Identity Protection and the CSPM capabilities within CrowdStrike Cloud Security
Proactively identify identity-based threats, misconfigurations, and cloud security gaps; drive remediation to closure in accordance with client policies and procedures
Configure, tune, and maintain identity protection policies, IOM and IOA policies, and risk-based authentication controls
Serve as the escalation point and trusted technical advisor to client leadership on identity and cloud security matters
Develop runbooks, detection logic, and automation to reduce manual effort and improve response times
Monitor the threat landscape and translate emerging risks into actionable hardening recommendations
Coordinate and lead governance calls with stakeholders; produce agenda, notes, and follow-up actions independently
Partner with other cybersecurity teams to integrate CrowdStrike telemetry into broader security operations
Produce metrics, dashboards, and executive-level reporting on identity and cloud security posture
Apply deep knowledge of identity-based attack techniques — including lateral movement, credential theft, Kerberoasting, and pass-the-hash — to inform detection and response strategy

Requirements

Must-Have:

7+ years of cybersecurity experience with a minimum of 2–3 years of hands-on administration of the CrowdStrike Falcon platform
Demonstrated expertise with CrowdStrike Falcon Identity Protection, including policy configuration, threat detection, and conditional access
Strong working knowledge of CrowdStrike Cloud Security, specifically CSPM
Deep understanding of identity and access management concepts: Active Directory, Azure AD/Entra ID, LDAP, Kerberos, SAML, and OAuth
Hands-on cloud security experience with Microsoft Azure including IAM, network security, and posture management
Solid understanding of privileged access management and identity-based attack techniques (lateral movement, credential theft, Kerberoasting, pass-the-hash)
Proven ability to work autonomously, set priorities, and drive outcomes without close supervision
Strong written and verbal communication skills, including ability to explain technical risk to non-technical stakeholders
Background in consulting or client-facing delivery roles
Bachelor's degree in a related field or equivalent practical experience (4 additional years of relevant experience)
At least one of the following active certifications: CWNE, CNDA (EC-Council), CEH (EC-Council), GPPA (GIAC), GCUX (GIAC), GCWN (GIAC), GMON (GIAC), GSE (GIAC), ITIL v3 Foundations, CCSP (ISC2), CISSP (ISC2), CISSP-ISSAP (ISC2), CISSP-ISSEP (ISC2), SSCP (ISC2), GWEB (GIAC), GISF (GIAC), GISP (GIAC), GSSP-.NET (GIAC), GSSP-JAVA (GIAC), GSEC (GIAC), or GSLC (GIAC)
US Citizenship or Permanent Residency required; must be eligible for and willing to obtain a public trust clearance
All work must be performed within the continental United States

Preferred / Nice-to-Have:

CrowdStrike Certified Cyber Security (CCCS) certification
Experience with Splunk and ServiceNow SOMS
Familiarity with Zero Trust architecture and frameworks including NIST and MITRE ATT&CK
Experience integrating CrowdStrike with third-party identity and security tooling
Previous federal contracting experience

Skill(s)

Technical Skills:

CrowdStrike Falcon Identity Protection (ITDR) — policy configuration, detection tuning, conditional access
CrowdStrike Cloud Security / CSPM — IOM and IOA policy management, cloud posture assessment
Microsoft Azure — IAM, Entra ID, network security, posture management
Active Directory and Azure Active Directory / Entra ID administration
Identity and access management protocols: LDAP, Kerberos, SAML, OAuth
Privileged access management (PAM) concepts and tooling
Threat detection and identity-based attack technique knowledge (lateral movement, Kerberoasting, pass-the-hash, credential theft)
Runbook and detection logic development
Security metrics and executive reporting / dashboard creation
Automation development for security operations
Splunk (preferred)
ServiceNow SOMS (preferred)
Zero Trust architecture frameworks (NIST, MITRE ATT&CK)

Soft Skills:

Self-directed initiative — proactively identifies risks and drives solutions without waiting for direction
Executive-level communication — translates complex technical risk to non-technical stakeholders
Governance and stakeholder management — owns and leads recurring client governance calls
Critical thinking and independent judgment
Continuous improvement mindset
Accountability — treats the client's security posture as their own
Written communication — runbooks, reports, recommendations

Benefits

Dragonfli Group offers a comprehensive benefits package that includes:

Medical — Multiple POS health plan options including an HSA-compatible plan

Dental — PPO coverage for preventive, basic, and major services

Vision — Annual exam, frames, lenses, and contact lens allowance

401(k) — Employer match up to 5% of eligible compensation

PTO — 15–25 days annually based on tenure

Paid Federal Holidays — All 11 federal holidays observed

Travel

null

Dragonfli Group

Latest Jobs

CrowdStrike Identity Security Engineer (ITDR/CSPM)