Job Description

Roles & Responsibilities

Responsibilities:

EDR Platform Management:

Administer and maintain enterprise EDR solutions (e.g., CrowdStrike, Sentinel One, Microsoft Defender for Endpoint).
Ensure optimal configuration, performance, and coverage across all endpoints.
Define endpoint telemetry strategies, agent deployment models, and data retention policies.
Ensure scalability, performance, and resilience of EDR infrastructure across hybrid environments.

Platform Deployment & Integration:

Lead deployment and configuration of EDR agents across diverse operating systems and environments.
Integrate EDR with SIEM, SOAR, and threat intelligence platforms to enable automated detection and response.

Detection Engineering:

Develop and fine-tune custom detection rules, behavioral analytics, and response playbooks.
Collaborate with threat hunters and incident responders to enhance detection logic and reduce false positives.

Operational Optimization:

Incident Response Enablement:

Provide engineering support during endpoint-related security incidents.
Working with the SOC Analysts to facilitate and effective Monitoring and analysis of EDR alerts to identify malicious activity.
Align with Incident Responders to facilitate investigations into endpoint-related incidents and coordinate response efforts.

Documentation & Compliance:

Maintain detailed documentation of EDR architecture, configurations, and operational procedures.
Ensure alignment with regulatory frameworks and internal security policies.

Use Case & Rule Development:

Develop and fine-tune detection rules, behavioral analytics, and response playbooks.
Collaborate with threat intelligence, Incident Response, and SOC Monitoring teams to enhance detection capabilities.

Automation & Integration:

Reporting & Documentation:

Generate reports on EDR activity, threat trends, and system health.
Maintain detailed documentation of configurations, procedures, and incident handling.

Collaboration & Mentorship:

Work closely with SOC analysts, IT, and security teams to improve endpoint security posture.

Desired Candidate Profile

Qualifications:

Years of Experience

A minimum of 5 years of experience in SOC operations, with significant experience in EDR Management

Prior experience in a technical role within a SOC or similar cybersecurity environment.

Education

Bachelor s degree in computer science, Information Technology, Cybersecurity, or a related field.

Skills/Certifications

Vendor certified EDR Engineer.
Endpoint security concepts such as knowledge of persistence attack methods, malware detection indicators amongst others.
Technical expertise in one or more of the leading EDR solutions such as Crowd Strike, Microsoft Defender, Sentinel One, Trend Micro etc.
Cloud-related certifications like AWS Certified Solutions Architect, Google Professional Cloud Architect, or Microsoft Certified: Azure Solutions Architect Expert

Senior SOC Engineer (EDR) Group 42

People Looking for Jobs also searched