Endpoint Security Operations Engineer (L2) – Microsoft Defender

Team: IT

Location: India

Commitment: Full-time

Workplace Type: remote

Accountabilities

• Provide L2 operational support for Microsoft Defender alerts, incidents, and service requests.

• Investigate endpoint detection alerts, malware detections, suspicious activity, and security incidents using Microsoft Defender for Endpoint.

• Analyze device timelines, alert evidence, process activity, and investigation data to assess the scope and potential impact of threats.

• Troubleshoot Defender sensor health, endpoint onboarding, connectivity, policy application, reporting, antivirus scans, and signature updates.

• Support approved threat containment and remediation actions, including device isolation and validation of endpoint security restoration.

• Assist with threat hunting, evidence collection, vulnerability remediation, and escalated security investigations in coordination with SOC and L3 teams.

• Monitor endpoint protection coverage, device risk status, security dashboards, and compliance gaps; coordinate corrective actions with relevant teams.

• Support endpoint onboarding and offboarding in Defender, security policy administration, audit evidence collection, and compliance reporting.

• Manage incidents within defined SLAs and follow established incident, problem, change, and security incident management procedures.

• Participate in major incident response, service restoration, and post-incident reviews.

• Maintain investigation records, incident timelines, runbooks, operational documentation, and shift handover notes.

• Coordinate with L1/L3 operations, SOC, Endpoint, Identity, Network, and Infrastructure teams, escalating complex threats and platform issues appropriately.

• Ensure effective follow-the-sun operational handovers across APAC, EMEA, and North America.

Requirements:

• 3–6 years of experience in enterprise security operations, Microsoft Defender administration, endpoint protection, or security incident support.

• Hands-on experience with Microsoft Defender for Endpoint and its alert investigation and security response capabilities.

• Strong understanding of endpoint protection, malware detection, threat analysis, and security incident handling.

• Experience investigating security alerts, device timelines, suspicious processes, and endpoint activity.

• Knowledge of Defender onboarding, sensor health, security policies, endpoint protection configurations, and device compliance.

• Good understanding of Windows operating systems, endpoint administration, and basic PowerShell.

• Familiarity with incident severity assessment, containment, remediation, and escalation procedures.

• Experience using the Microsoft Defender portal and security monitoring dashboards.

• Familiarity with or equivalent IT service management tools and incident management workflows.

• Experience working in enterprise production environments or 24/7 security operations.

• Strong analytical, troubleshooting, documentation, communication, and cross-functional coordination skills.

• Preferred: Microsoft SC-200 or an equivalent security operations certification.

• Preferred: Exposure to Microsoft Defender XDR, Microsoft Sentinel, KQL, threat hunting, and endpoint investigation techniques.

• Preferred: Familiarity with Microsoft Defender for Identity, Defender for Office 365, vulnerability management, and security compliance.

• Preferred: Experience with PowerShell scripting and security operations automation.

Benefits:

• Remote working arrangement within India.

• Opportunity to work with Microsoft security technologies and enterprise endpoint protection environments.

• Exposure to global security operations and collaboration across international teams.

• Professional development through hands-on experience in threat investigation, incident response, and endpoint security.

• Collaborative environment focused on innovation, continuous learning, and inclusive teamwork.

• Salary, healthcare coverage, insurance, paid leave, and additional benefits are not specified in the job description.