Software Engineer – Sensor, Sensor Performance and Stability (Hybrid)

As a global leader in cybersecurity, CrowdStrike protects the people, processes and technologies that drive modern organizations. Since 2011, our mission hasn’t changed — we’re here to stop breaches, and we’ve redefined modern security with the world’s most advanced AI-native platform. We work on large scale distributed systems, processing almost 3 trillion events per day and this traffic is growing daily. Our customers span all industries, and they count on CrowdStrike to keep their businesses running, their communities safe and their lives moving forward. We're proud to work for a mission-driven company leveraging AI to transform the way we work. CrowdStrikers drive their careers through flexibility and autonomy while also being expected to contribute to a culture of responsible AI adoption, experimentation, and innovation. We use an AI-first mindset as a force multiplier to proactively and continuously accelerate execution, build expertise, uncover insights, and solve complex problems. We’re always looking to add talented CrowdStrikers to the team who have limitless passion, a relentless focus on innovation and a fanatical commitment to our customers, our community and each other. Ready to join a mission that matters? The future of cybersecurity starts with you. About The Role: CrowdStrike Falcon is a two-component security product. One component is the "Sensor" — a lightweight agent installed on endpoint systems that observes system activity, recognizes malicious behavior, provides on-box prevention capability, and sends telemetry to the Falcon cloud. The cloud component aggregates Sensor telemetry across each customer's network, correlates malicious behavior across machines, and presents security teams with a prioritized summary of the threats detected in their environments. The Falcon Sensor runs on tens of millions of endpoints worldwide, across Windows, macOS and Linux, in both user mode and kernel mode. Engineering software at that depth and that scale is among the hardest problems in the industry, and CrowdStrike holds the Sensor to an exceptionally high standard of quality, performance and engineering rigor. Sustaining that standard requires a team with true mastery of what software does at runtime, at the lowest levels of the stack. That team is Sensor Performance and Reliability — CrowdStrike's team of debug engineers. Deep runtime analysis is our craft: postmortem memory dump analysis, disassembly and reverse engineering, and source-level analysis, used to explain with precision and evidence how low-level code behaves on real systems. It is one of the most technically demanding specialties in systems engineering, and very few organizations invest in it as a discipline in its own right. We do, because at our scale the answer to "what exactly happened, and why?" has to be exact rather than approximate. Our mandate goes further than answering that question well. We're chartered to turn what we learn from deep analysis into durable engineering improvements — strengthening diagnostics, tooling, validation coverage and development practices so that lessons generalize far beyond the investigation that produced them, and so that the next analysis is faster than the last. Our work makes the product stronger, and it raises the engineering capability of every team we work with. We are hiring an entry-level engineer to join us in that mission. We do not expect you to arrive with deep Windows internals, assembly, or reverse engineering experience. Those are skills we will teach you, and you will learn them from engineers who operate at the top of this field. What we are looking for is a strong programmer with excellent problem-solving instincts and genuine curiosity about how computers actually work underneath the abstractions — someone who is drawn to a hard, ambiguous problem rather than put off by it. If you are the kind of person who cannot leave a mystery alone until you understand it completely, this is an unusually good place to build a career. Location: This is a hybrid role based out of one of the posted locations: Redmond, WA or Sunnyvale, CA , with a combination of in-office and remote work. What You'll Do: Analyze the runtime behavior of complex low-level software across user mode and kernel mode on Windows, primarily through postmortem memory dump analysis in WinDbg. Work from raw memory, register state and disassembly to a precise, evidence-backed account of what executing code did and why — and hold yourself to a high evidentiary bar in reaching it. Correlate your analysis with source code, applying reverse engineering and disassembly techniques where symbols, source or context are incomplete. Drive investigations to accurate, well-reasoned conclusions rather than plausible-sounding ones, and communicate confidence and uncertainty honestly. Partner with Sensor development teams to translate your findings into concrete, well-designed engineering improvements. Generalize from individual investigations: recognize patterns, and champion improvements to tooling, diagnostics, automated validation and engineering practice that raise the reliability bar broadly rather than locally. Build and improve the tooling, automation and analysis techniques that make deep runtime analysis faster, more repeatable and more accessible — for our team and for Sensor engineers across the company. Write clearly and precisely for engineering, quality and leadership audiences. A first-rate technical analysis is only as valuable as its reader's ability to act on it. Collaborate with engineering teams across multiple locations and timezones, including Sensor platform, detection and OS-specialist teams. What You'll Need: BS in Computer Science, Computer Engineering, or equivalent practical experience. Solid working knowledge of C and C++, and the ability to read and reason about code you did not write. Good foundational knowledge of data structures and algorithms. Strong problem-solving and analytical skills, and comfort working with incomplete information — much of this work involves reconstructing runtime behavior from partial evidence. Genuine curiosity about systems fundamentals: operating system internals, computer architecture, memory management, concurrency, compilers and assembly. You should want to learn these deeply. Persistence and intellectual honesty: the willingness to keep digging until you actually know the answer, and to say clearly when you don't yet. Good written and verbal communication skills. Ability to take ownership of your work and follow it through to resolution. Ability to communicate, collaborate, and work effectively in a globally distributed team. Proven experience utilizing AI technologies to enhance decision-making, streamline workflows and processes, improve efficiency and drive business outcomes. Bonus Points: Any exposure to debugging tools and techniques — WinDbg, GDB, LLDB, or similar — including as a hobby, in coursework, or in CTFs. Coursework, internships, or personal projects involving operating system internals, kernel or driver development, systems programming, or computer architecture. Familiarity with x86-64 or ARM64 assembly and the ability to read disassembly. Exposure to reverse engineering, malware analysis, or vulnerability research. Experience with Windows internals specifically (processes, threads, virtual memory, synchronization, the Windows kernel and driver model). Scripting experience, particularly Python, for automation and analysis tooling. Interest in or experience with the security landscape. #LI-CW1 Benefits of Working at CrowdStrike: Market leader in compensation and equity awards Comprehensive physical and mental wellness programs Competitive vacation and holidays for recharge Paid parental and adoption leaves Professional development opportunities for all employees regardless of level or role Employee Networks, geographic neighborhood groups, and volunteer opportunities to bui