Client: Elections Saskatchewan (ESK)

Job Title: Cybersecurity Expert – CrowdStrike Falcon / Security Monitoring

Location: Fully Remote – Saskatchewan, Canada

Work Arrangement: Remote; fully remote resources will be considered

Engagement Type: Statement of Work (SOW)

Estimated Effort: Approximately 80–120 hours

Start Date: As soon as possible

End Date: December 31, 2026, or earlier based on completion of deliverables and milestones

Resources Requested: 1 fully qualified resource

Minimum Experience: No prescribed minimum level of experience

RFR Reference: ESK-RFR-IT-2026-004

Issued Under: ESK-2025-003-RFPQ

Date Issued: August 27, 2026

Closing Date: September 11, 2026 at 2:00 PM CST

Position Overview

Elections Saskatchewan (ESK) is seeking an experienced Cybersecurity Expert to review, validate, and optimize its security monitoring environment.

ESK uses the CrowdStrike Falcon platform for endpoint and server protection, threat intelligence, and continuous monitoring, and it is now the core of ESK's detection and response capability.

ESK is seeking independent assurance that the platform is configured correctly, monitoring is set up optimally, and ESK is fully leveraging the capabilities available within CrowdStrike Falcon.

The emphasis of this engagement is CrowdStrike Falcon expertise, complemented by broader working knowledge of security monitoring and detection tooling.

Important

This is not a scanning, vulnerability-assessment, or penetration-testing engagement.

The selected resource will focus on CrowdStrike Falcon configuration, tuning, optimization, security monitoring, detection, alerting, SIEM integration, and cybersecurity posture assessment.

Work Arrangement & Engagement Details

- Fully remote resources will be considered.
- Occasional meetings with ESK stakeholders may be required.
- ESK will provide the necessary hardware and system access.
- The engagement is estimated to require approximately 80–120 hours of effort.
- The SOW would commence as soon as possible and shall expire on December 31, 2026, or earlier based on completion of the deliverables and milestones agreed to at the outset of the engagement.
- The term may be extended if mutually agreed to in writing by both parties in accordance with the Master Services Agreement.

Experience Requirement

There is no prescribed minimum level of experience for this engagement.

Proponents should use the evaluation criteria and response table included in the RFR to demonstrate the candidate's relevant experience, qualifications, and expertise.

ESK will evaluate submissions based on the information provided in the response table and the overall fit of the proposed resource to the requirements of the engagement.

Key Responsibilities

The selected resource will be required to:

1. CrowdStrike Falcon Configuration & Optimization





- Review ESK's CrowdStrike Falcon configuration and confirm it is set up correctly and tuned to ESK's setting.
- Configure, tune, and optimize the CrowdStrike Falcon platform.
- Review endpoint and server protection capabilities.
- Assess CrowdStrike Falcon Next-Gen SIEM capabilities.
- Review threat intelligence and continuous monitoring capabilities.
- Identify areas where the CrowdStrike Falcon platform is under-utilized.
- Recommend opportunities to fully leverage available CrowdStrike capabilities.

2. Security Monitoring, Detection & Alerting

- Assess whether ESK's monitoring, alerting, log ingestion, and retention are configured optimally.
- Validate and optimize CrowdStrike detection capabilities.
- Validate and optimize alerting.
- Review and optimize dashboards.
- Assess log ingestion.
- Assess data retention.
- Identify gaps and opportunities to improve security monitoring and detection capabilities.

3. SIEM & Log Integration

- Evaluate how CrowdStrike and ESK's other monitoring controls work together.
- Identify opportunities to bring additional log sources into the SIEM.
- Assess opportunities to integrate additional security and operational data sources.
- Provide recommendations for improving SIEM visibility and monitoring.

Potential additional log sources may include:
- File-share logs
- Audit logs
- Network monitoring data
- Other relevant security and operational logs

4. Cybersecurity Environment Assessment

- Assess ESK's overall cybersecurity environment.
- Conduct a cybersecurity posture assessment.
- Identify key findings, security gaps, configuration issues, and areas of under-utilization.
- Evaluate existing security monitoring and threat-detection capabilities.
- Provide practical and prioritized recommendations.
- Provide clear remediation guidance.

5. Reporting & Documentation

- Prepare and deliver a comprehensive written report documenting the assessment of ESK's overall cybersecurity environment.
- Clearly document key findings.
- Provide actionable recommendations.
- Provide prioritized remediation guidance.
- Communicate findings clearly to both technical and management audiences.
- Produce professional cybersecurity documentation.

Required Qualifications

The preferred resource must have:

CrowdStrike Falcon Expertise

- Demonstrated, hands-on expertise configuring, tuning, and optimizing the CrowdStrike Falcon platform.
- Experience with endpoint protection.
- Experience with server protection.




- Experience with Next-Gen SIEM.
- Experience with threat intelligence.
- Experience with continuous monitoring.
- Experience validating and optimizing CrowdStrike detection.
- Experience validating and optimizing alerting.
- Experience with CrowdStrike dashboards.
- Experience with log ingestion.
- Experience with data retention.

Security Monitoring & Threat Detection

- Working experience with security monitoring and threat-detection tooling beyond a single vendor.
- Experience with network monitoring.
- Experience with log/SIEM integration.
- Ability to evaluate how multiple security monitoring controls work together.
- Experience identifying opportunities to improve security visibility and detection.

Cybersecurity Assessment

- Proven ability to assess an existing security environment.
- Experience conducting cybersecurity posture assessments.
- Ability to identify security gaps and areas of improvement.
- Ability to provide practical, prioritized recommendations.
- Ability to provide remediation guidance.

Communication & Documentation

- Strong analytical and problem-solving skills.
- Ability to communicate clearly.
- Ability to produce professional documentation.
- Ability to communicate technical findings effectively to both technical and management audiences.

Preferred Qualifications

It is preferred that the resource also have:
- Relevant industry or vendor certifications.
- CrowdStrike Falcon certifications or an equivalent recognized security certification.
- Experience integrating additional log sources, such as file-share and audit logs, into a SIEM.
- Familiarity with recognized frameworks such as the NIST Cybersecurity Framework.

CrowdStrike Falcon Modules & Components

Candidates should list the specific CrowdStrike Falcon modules and components with which they have hands-on experience and describe their experience with each.

Examples include

- CrowdStrike Falcon Next-Gen SIEM
- CrowdStrike Insight / EDR
- CrowdStrike Prevent
- Endpoint Protection
- Server Protection
- Threat Intelligence
- Continuous Monitoring
- Detection & Alerting
- Dashboards
- Log Ingestion
- Data Retention

Key Deliverables

The selected resource will be expected to provide:
1. CrowdStrike Falcon configuration review.
2. CrowdStrike Falcon tuning and optimization assessment.
3. Monitoring assessment.
4. Detection and alerting assessment.
5. Dashboard assessment.
6. Log ingestion assessment.
7. Data retention assessment.
8. SIEM integration assessment.
9. Additional log-source integration recommendations.
10. Cybersecurity posture assessment.
11. Identification of key findings and gaps.
12. Prioritized recommendations.
13. Remediation guidance.
14. Comprehensive written cybersecurity assessment report.
15. Communication of findings to technical and management stakeholders.

📌 Cybersecurity Expert – CrowdStrike Falcon / Security Monitoring (Regina)
🏢 E-Talent Network
📍 Regina