Endpoint Security Operations Engineer – Microsoft Defender
Employment Information
Report this job
Job expired or something wrong with this job?
Job Description
Endpoint Security Operations Engineer operating Microsoft Defender for Gruve’s enterprise cybersecurity services. Investigating threats, remediating incidents, and maintaining endpoint compliance across global 24x7 operations.
Responsibilities:
- Provide L2 support for Microsoft Defender alerts, incidents and service requests
- Investigate endpoint detection alerts, malware detections, suspicious activities and security incidents using Microsoft Defender for Endpoint
- Analyze device timelines, alert evidence, process activity and investigation data to determine incident scope
- Troubleshoot Defender sensor health, onboarding, connectivity, policy application and reporting issues
- Support approved threat containment and remediation activities, including device isolation and threat remediation
- Investigate antivirus detection, scan failures, signature updates and endpoint protection configuration issues
- Monitor endpoint protection status and coordinate remediation of Defender health and compliance gaps
- Investigate escalated security alerts and determine appropriate response actions within approved procedures
- Support threat hunting, incident investigation and evidence collection as required
- Coordinate with SOC and L3 Security teams for complex or high-severity incidents
- Execute authorized remediation actions and validate endpoint security restoration
- Support vulnerability and exposure remediation activities using Microsoft security tools where applicable
- Maintain incident timelines, investigation evidence and remediation records
- Support Microsoft Defender portal operations, security policies and endpoint protection configurations within authorized scope
- Monitor security dashboards, device risk status, protection coverage and sensor health
- Support onboarding and offboarding of endpoints into Defender in coordination with Endpoint teams
- Investigate security policy deviations and coordinate corrective actions with relevant teams
- Support security reporting, audit evidence collection and compliance activities
- Resolve security operations incidents within defined SLAs and escalation procedures
- Follow Incident, Problem, Change and Security Incident Management processes
- Participate in major incident response, service restoration and post-incident reviews
- Maintain runbooks, investigation procedures, operational documentation and shift handover notes
- Coordinate with L1/L3, SOC, Endpoint, Identity, Network and Infrastructure teams
- Escalate complex threats, platform issues and incidents requiring advanced investigation to L3/SOC
- Ensure effective APAC–EMEA–NLAM follow-the-sun handovers
Requirements:
- 3–6 years of experience in enterprise security operations, Microsoft Defender administration, endpoint protection or security incident support
- Hands-on experience with Microsoft Defender for Endpoint and its security investigation capabilities
- Knowledge of endpoint protection, malware detection, threat analysis and security incident handling
- Experience investigating security alerts, device timelines, suspicious processes and endpoint activity
- Understanding of Defender onboarding, sensor health, security policies and endpoint protection status
- Knowledge of Windows operating systems, endpoint administration and basic PowerShell
- Understanding of incident severity, containment, remediation and escalation procedures
- Familiarity with Microsoft Defender portal and security monitoring dashboards
- Experience with ServiceNow or equivalent ITSM tools and incident management processes
- Strong analytical, documentation and cross-team coordination skills
- Experience in enterprise 24x7 production or security operations
- Microsoft SC-200 or equivalent security operations certification (preferred)
- Exposure to Microsoft Defender XDR, Microsoft Sentinel and KQL (preferred)
- Knowledge of threat hunting, attack techniques and endpoint investigation (preferred)
- Familiarity with Microsoft Defender for Identity and Defender for Office 365 (preferred)
- Experience with vulnerability management, security compliance and incident reporting (preferred)
- PowerShell scripting and security operations automation experience (preferred)
Benefits:
- Dynamic environment with strong customer and partner networks
- Culture of innovation, collaboration, and continuous learning
- Diverse and inclusive workplace
- Equal opportunity employer
Similar Jobs
Security Operations Analyst L1 – MS Defender
Security Operations Analyst monitoring Microsoft Defender alerts and endpoint protection for Gruve, an AI-focused software services startup. Performing L1 triage, incident logging, escalation, and 24x7 security operations support.
Soc Analyst
SOC Analyst investigating security alerts, malware, and incidents for Cynet’s AI-powered threat detection platform. Performing threat hunting, digital forensics, and incident response for global customers.
Soc Analyst
SOC Analyst investigating alerts, malware, and live incidents for Cynet’s AI-powered threat detection platform. Performing threat hunting, digital forensics, and malware analysis for global customers.
Soc Analyst
SOC Analyst investigating security alerts, malware, and incidents for Cynet’s AI-powered threat detection platform. Performing digital forensics and threat hunting for global customers.
Manager, Security Operations Center
Security Operations Center Manager leading Workstreet’s 24x7 client monitoring, detection, and incident escalation operations. Managing analysts, SLAs, security tooling, and compliance-focused service delivery.
Cloud Architect – Operations, Security Governance
Arquitecto Cloud senior diseñando modelos operativos y de madurez de seguridad para Landing Zones AWS. Definiendo estándares, controles y roadmaps para entornos empresariales bancarios.
Senior Manager, Security Incident Response
Senior security leader directing global investigations and incident response for Affirm’s transparent fintech payment platform. Building scalable response, AI-enabled workflows, and executive risk reporting.
Senior Manager, Security Incident Response
Senior security leader directing Affirm’s global incident response and investigations. Building scalable detection, readiness, and AI-enabled security capabilities for fintech payments.
SOC Analyst
SOC Analyst monitoring Consensys’s blockchain infrastructure, enterprise systems, and Web3 protocols. Detecting threats, responding to incidents, and securing Linea and Lineth ZK-rollup ecosystems.
Senior Manager, A&D Security Operations
Senior Manager leading acquisition and divestiture cybersecurity operations for Johnson & Johnson’s global healthcare businesses. Managing transaction portfolios, risk governance, post-close coordination, and operational maturity.
Senior Manager, A&D Security Operations
Senior Manager leading cybersecurity operations for Johnson & Johnson acquisitions and divestitures. Managing transaction portfolios, risk governance, integrations, and executive reporting.
Cloud Architect – Operations, Security Governance
Cloud Architect definiendo modelos operativos, madurez de seguridad y roadmaps para Landing Zones AWS empresariales en Keppri. Impulsando gobierno, resiliencia, automatización y estandarización cloud.
Director, Global Security Operations Center
Director leading Twilio’s 24/7/365 global security operations center. Protecting Twilio’s communications technology, people, assets, and operations through intelligence-driven physical security.
Security Operations Analyst L2 – SOC
Security Operations Analyst monitoring alerts, investigating incidents, and maintaining compliance for Supply Chimp’s US government supply and logistics operations. Improving security tools, documentation, and controls remotely from Colombia.
Network Operations Security Engineer
Network Operations Security Engineer securing AXON Networks’ AI-driven ISP orchestration platform, routers, cloud, and Kubernetes services. Coordinating vulnerability remediation, incident readiness, and production security across North America.
Security Operations Team Lead
Security Operations Team Lead leading incident response, agentic SOC operations, and security engineering at Cyera. Securing enterprise AI adoption through internal customer-zero operations.
SecOps Engineer
SecOps Engineer monitoring threats and managing security operations for compliance software serving 50,000+ organisations globally. Supporting incident response, vulnerability management, cloud security, and regulatory compliance.
IAM Security Operations Engineer – Middle
IAM Security Operations Engineer maintaining secure identity services for SOFTSWISS. Managing JML lifecycle processes, RBAC access, Keycloak, Adaxes, and IAM integrations.
Blue Team Analyst – SOC
Analista Blue Team monitorando eventos, ameaças e incidentes em SOC para a It4us Cyber Security. Operação remota com ferramentas SIEM e suporte a clientes.
SOC Analyst II
SOC Analyst II protecting small and medium-sized businesses with enterprise-class cybersecurity. Leading threat investigations, incident response, threat hunting, and vulnerability management.