DTICI_CSOC_Endpoint Security Engineer_T9

Overview

Bengaluru, Karnataka, INOn-site

Responsibilities

Investigate and respond to endpoint security incidents from detection through containment, remediation, and closure under defined CSOC processes.
Perform in depth incident analysis to determine root cause, scope, severity, and business impact.
Monitor and analyze alerts generated from Microsoft Defender for Endpoint
Execute response actions such as device isolation, file quarantine, attack surface reduction actions, and indicator blocking.
Escalate complex or high‑severity endpoint incidents to IR team with structured analysis and supporting evidence.
Analyze endpoint telemetry including process execution, registry changes, file activity, and network connections.
Tune and refine endpoint security alerts, detection rules, and policies to reduce false positives and improve signal quality.
Support endpoint hardening initiatives including ASR rules, exploit protection, controlled folder access, and device control.
Coordinate with IT teams for vulnerability remediation, patch management, and secure configuration enforcement.
Maintain accurate documentation for incidents, investigations, and response actions.
Participate in post‑incident reviews and RCA sessions, contributing to corrective and preventive actions.
Provide technical guidance and knowledge sharing to L1/L2 SOC analysts on endpoint security topics.
Support audit, compliance, and internal review activities related to endpoint security operations.

Strong hands‑on experience with Microsoft Defender for Endpoint (MDE).
Working knowledge of the Microsoft 365 Defender ecosystem, including Defender for Office 365 and Defender for Identity.
Experience with endpoint detection, response, and remediation in enterprise environments.
Familiarity with MITRE ATT&CK techniques related to endpoint attacks.
Experience using SIEM platforms such as Microsoft Sentinel for alert correlation and investigation.
Ability to analyze endpoint telemetry and identify malicious or anomalous behavior.
Understanding of incident response lifecycle and SOC operations.
Basic exposure to threat intelligence consumption and IOC‑based investigations.
Solid understanding of Windows operating systems and endpoint security controls.
Knowledge of endpoint lifecycle management, patching, and vulnerability remediation.
Familiarity with network concepts relevant to endpoint investigations.

Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or Engineering (or equivalent experience).
2–4 years of cybersecurity experience, with strong exposure to endpoint security
Hands‑on enterprise experience with Microsoft Defender for Endpoint is mandatory.
Experience supporting medium‑severity security incidents is strongly preferred.