DTICI_CSOC_Endpoint Security Engineer_T9

Key Tasks & Responsibilities: 

• Investigate and respond to endpoint security incidents from detection through containment, remediation, and closure under defined CSOC processes.

• Perform in depth incident analysis to determine root cause, scope, severity, and business impact.

• Monitor and analyze alerts generated from Microsoft Defender for Endpoint

• Execute response actions such as device isolation, file quarantine, attack surface reduction actions, and indicator blocking.

• Escalate complex or high‑severity endpoint incidents to IR team with structured analysis and supporting evidence.

• Analyze endpoint telemetry including process execution, registry changes, file activity, and network connections.

• Tune and refine endpoint security alerts, detection rules, and policies to reduce false positives and improve signal quality.

• Support endpoint hardening initiatives including ASR rules, exploit protection, controlled folder access, and device control.

• Coordinate with IT teams for vulnerability remediation, patch management, and secure configuration enforcement.

• Maintain accurate documentation for incidents, investigations, and response actions.

• Participate in post‑incident reviews and RCA sessions, contributing to corrective and preventive actions.

• Provide technical guidance and knowledge sharing to L1/L2 SOC analysts on endpoint security topics.

• Support audit, compliance, and internal review activities related to endpoint security operations.

Key Skills:

• Strong hands‑on experience with Microsoft Defender for Endpoint (MDE).

• Working knowledge of the Microsoft 365 Defender ecosystem, including Defender for Office 365 and Defender for Identity.

• Experience with endpoint detection, response, and remediation in enterprise environments.

• Familiarity with MITRE ATT&CK techniques related to endpoint attacks.

• Experience using SIEM platforms such as Microsoft Sentinel for alert correlation and investigation.

• Ability to analyze endpoint telemetry and identify malicious or anomalous behavior.

• Understanding of incident response lifecycle and SOC operations.

• Basic exposure to threat intelligence consumption and IOC‑based investigations.

• Solid understanding of Windows operating systems and endpoint security controls.

• Knowledge of endpoint lifecycle management, patching, and vulnerability remediation.

• Familiarity with network concepts relevant to endpoint investigations.

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or Engineering (or equivalent experience).

• 2–4 years of cybersecurity experience, with strong exposure to endpoint security

• Hands‑on enterprise experience with Microsoft Defender for Endpoint is mandatory.

• Experience supporting medium‑severity security incidents is strongly preferred.