Software Engineer – Sensor, SaO (Hybrid)

Role details

As a global leader in cybersecurity, CrowdStrike protects the people, processes and technologies that drive modern organizations. Since 2011, our mission hasn’t changed — we’re here to stop breaches, and we’ve redefined modern security with the world’s most advanced AI-native platform. We work on large scale distributed systems, processing almost 3 trillion events per day and this traffic is growing daily. Our customers span all industries, and they count on CrowdStrike to keep their businesses running, their communities safe and their lives moving forward. We're proud to work for a mission-driven company leveraging AI to transform the way we work. CrowdStrikers drive their careers through flexibility and autonomy while also being expected to contribute to a culture of responsible AI adoption, experimentation, and innovation. We use an AI-first mindset as a force multiplier to proactively and continuously accelerate execution, build expertise, uncover insights, and solve complex problems. We’re always looking to add talented CrowdStrikers to the team who have limitless passion, a relentless focus on innovation and a fanatical commitment to our customers, our community and each other. Ready to join a mission that matters? The future of cybersecurity starts with you. About The Role: CrowdStrike Falcon is a two-component security product. One component is the "Sensor" — a lightweight agent installed on endpoint systems that observes system activity, recognizes malicious behavior, provides on-box prevention capability, and sends telemetry to the Falcon cloud. The cloud component aggregates Sensor telemetry across each customer's network, correlates malicious behavior across machines, and presents security teams with a prioritized summary of the threats detected in their environments. The Falcon Sensor runs on tens of millions of endpoints worldwide, across Windows, macOS and Linux, in both user mode and kernel mode. Engineering software at that depth and that scale is among the hardest problems in the industry, and CrowdStrike holds the Sensor to an exceptionally high standard of quality, performance and engineering rigor. Sustaining that standard requires a team with true mastery of what software does at runtime, at the lowest levels of the stack. That team is Sensor Performance and Reliability — CrowdStrike's team of debug engineers. Deep runtime analysis is our craft: postmortem memory dump analysis, disassembly and reverse engineering, and source-level analysis, used to explain with precision and evidence how low-level code behaves on real systems. It is one of the most technically demanding specialties in systems engineering, and very few organizations invest in it as a discipline in its own right. We do, because at our scale the answer to "what exactly happened, and why?" has to be exact rather than approximate. Our mandate goes further than answering that question well. We're chartered to turn what we learn from deep analysis into durable engineering improvements — strengthening diagnostics, tooling, validation coverage and development practices so that lessons generalize far beyond the investigation that produced them, and so that the next analysis is faster than the last. Our work makes the product stronger, and it raises the engineering capability of every team we work with. We are hiring an entry-level engineer to join us in that mission. We do not expect you to arrive with deep Windows internals, assembly, or reverse engineering experience. Those are skills we will teach you, and you will learn them from engineers who operate at the top of this field. What we are looking for is a strong programmer with excellent problem-solving instincts and genuine curiosity about how computers actually work underneath the abstractions — someone who is drawn to a hard, ambiguous problem rather than put off by it. If you are the kind of person who cannot leave a mystery alone until you understand it completely, this is an unusually good place to build a career. Location: This is a hybrid role based out of one of the posted locations: Redmond, WA or Sunnyvale, CA , with a combination of in-office and remote work. What You'll Do: Analyze the runtime behavior of complex low-level software across user mode and kernel mode on Windows, primarily through postmortem memory dump analysis in WinDbg. Work from raw memory, register state and disassembly to a precise, evidence-backed account of what executing code did and why — and hold yourself to a high evidentiary bar in reaching it. Correlate your analysis with source code, applying reverse engineering and disassembly techniques where symbols, source or context are incomplete. Drive investigations to accurate, well-reasoned conclusions rather than plausible-sounding ones, and communicate confidence and uncertainty honestly. Partner with Sensor development teams to translate your findings into concrete, well-designed engineering improvements. Generalize from individual investigations: recognize patterns, and champion improvements to tooling, diagnostics, automated validation and engineering practice that raise the reliability bar broadly rather than locally. Build and improve the tooling, automation and analysis techniques that make deep runtime analysis faster, more repeatable and more accessible — for our team and for Sensor engineers across the company. Write clearly and precisely for engineering, quality and leadership audiences. A first-rate technical analysis is only as valuable as its reader's ability to act on it. Collaborate with engineering teams across multiple locations and timezones, including Sensor platform, detection and OS-specialist teams. What You'll Need: BS in Computer Science, Computer Engineering, or equivalent practical experience. Solid working knowledge of C and C++, and the ability to read and reason about code you did not write. Good foundational knowledge of data structures and algorithms. Strong problem-solving and analytical