Job Description

Key Tasks & Responsibilities:

• Investigate and respond to endpoint security incidents from detection through containment, remediation, and closure under defined CSOC processes.
• Perform in depth incident analysis to determine root cause, scope, severity, and business impact.
• Monitor and analyze alerts generated from Microsoft Defender for Endpoint
• Execute response actions such as device isolation, file quarantine, attack surface reduction actions, and indicator blocking.
• Escalate complex or high‑severity endpoint incidents to IR team with structured analysis and supporting evidence.
• Analyze endpoint telemetry including process execution, registry changes, file activity, and network connections.
• Tune and refine endpoint security alerts, detection rules, and policies to reduce false positives and improve signal quality.
• Support endpoint hardening initiatives including ASR rules, exploit protection, controlled folder access, and device control.
• Coordinate with IT teams for vulnerability remediation, patch management, and secure configuration enforcement.
• Maintain accurate documentation for incidents, investigations, and response actions.
• Participate in post‑incident reviews and RCA sessions, contributing to corrective and preventive actions.
• Provide technical guidance and knowledge sharing to L1/L2 SOC analysts on endpoint security topics.
• Support audit, compliance, and internal review activities related to endpoint security operations.

Key Skills:

• Strong hands‑on experience with Microsoft Defender for Endpoint (MDE).
• Working knowledge of the Microsoft 365 Defender ecosystem, including Defender for Office 365 and Defender for Identity.
• Experience with endpoint detection, response, and remediation in enterprise environments.
• Familiarity with MITRE ATT&CK techniques related to endpoint attacks.
• Experience using SIEM platforms such as Microsoft Sentinel for alert correlation and investigation.
• Ability to analyze endpoint telemetry and identify malicious or anomalous behavior.
• Understanding of incident response lifecycle and SOC operations.
• Basic exposure to threat intelligence consumption and IOC‑based investigations.
• Solid understanding of Windows operating systems and endpoint security controls.
• Knowledge of endpoint lifecycle management, patching, and vulnerability remediation.
• Familiarity with network concepts relevant to endpoint investigations.
• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or Engineering (or equivalent experience).
• 2–4 years of cybersecurity experience, with strong exposure to endpoint security
• Hands‑on enterprise experience with Microsoft Defender for Endpoint is mandatory.
• Experience supporting medium‑severity security incidents is strongly preferred.