Endpoint Security Operations Engineer – Microsoft Defender

This is a fully remote position, open to applicants in India.

📋 Description

• Deliver Level 2 support for alerts, incidents, and service requests related to Microsoft Defender.

• Examine endpoint detection alerts, malware alerts, suspicious activities, and security incidents utilizing Microsoft Defender for Endpoint.

• Assess device timelines, alert evidence, process activities, and investigation data to ascertain the scope of incidents.

• Diagnose issues related to Defender sensor health, onboarding, connectivity, policy application, and reporting.

• Assist in sanctioned threat containment and remediation efforts, including device isolation and threat mitigation.

• Investigate antivirus detections, scan failures, signature updates, and endpoint protection configuration challenges.

• Oversee the status of endpoint protection and manage the remediation of health and compliance gaps in Defender.

• Analyze escalated security alerts and identify suitable response actions in line with approved protocols.

• Facilitate threat hunting, incident investigations, and evidence gathering as needed.

• Collaborate with SOC and Level 3 Security teams for intricate or high-severity incidents.

• Implement authorized remediation measures and confirm the restoration of endpoint security.

• Aid in vulnerability and exposure remediation activities using applicable Microsoft security tools.

• Maintain timelines of incidents, investigation evidence, and records of remediation.

• Support operations of the Microsoft Defender portal, security policies, and endpoint protection setups within allowed scope.

• Monitor security dashboards, device risk statuses, protection coverage, and sensor health.

• Assist in the onboarding and offboarding of endpoints into Defender in collaboration with Endpoint teams.

• Investigate deviations from security policies and coordinate corrective measures with relevant teams.

• Contribute to security reporting, audit evidence collection, and compliance initiatives.

• Resolve security operations incidents in accordance with established SLAs and escalation procedures.

• Adhere to Incident, Problem, Change, and Security Incident Management processes.

• Engage in major incident responses, service restoration efforts, and post-incident evaluations.

• Maintain runbooks, investigation procedures, operational documentation, and shift transition notes.

• Coordinate with Level 1/Level 3, SOC, Endpoint, Identity, Network, and Infrastructure teams.

• Escalate complex threats, platform concerns, and incidents necessitating advanced investigation to Level 3/SOC.

• Ensure efficient APAC–EMEA–NLAM follow-the-sun handovers.

⛳️ Requirements

• 3 to 6 years of experience in enterprise security operations, Microsoft Defender administration, endpoint protection, or security incident support.

• Practical experience with Microsoft Defender for Endpoint and its security investigation functionalities.

• Knowledge of endpoint protection, malware detection, threat analysis, and the handling of security incidents.

• Experience in investigating security alerts, device timelines, suspicious processes, and endpoint activities.

• Understanding of Defender onboarding, sensor health, security protocols, and endpoint protection status.

• Familiarity with Windows operating systems, endpoint administration, and basic PowerShell.

• Comprehension of incident severity, containment, remediation, and escalation protocols.

• Knowledge of the Microsoft Defender portal and security monitoring dashboards.

• Experience with ServiceNow or similar ITSM tools and incident management processes.

• Strong analytical abilities, documentation skills, and cross-team coordination capabilities.

• Experience in enterprise 24x7 production or security operations.

• Preferred: Microsoft SC-200 or an equivalent security operations certification.

• Preferred: Exposure to Microsoft Defender XDR, Microsoft Sentinel, and KQL.

• Preferred: Knowledge of threat hunting, attack techniques, and endpoint investigations.

• Preferred: Familiarity with Microsoft Defender for Identity and Defender for Office 365.

• Preferred: Experience in vulnerability management, security compliance, and incident reporting.

• Preferred: PowerShell scripting and automation of security operations experience.

🏝️ Benefits

• Dynamic environment with robust customer and partner networks.

• Culture that promotes innovation, collaboration, and continuous learning.

• A diverse and inclusive workplace.

• Equal opportunity employer.