Endpoint Security Operations Engineer – Microsoft Defender

Job not on LinkedIn

🔥 1 hour ago

🇮🇳 India – Remote

⏰ Full Time

🟡 Mid-level

🟠 Senior

🛡️ Security Operations

👻 Ghost score 10%

What it means: the chance that no one is really hiring for this job.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Gruve

WebsiteLinkedInAll Job Openings

201 - 500 employees

Founded 2024

🤖 Artificial Intelligence

🔒 Cybersecurity

🏢 Enterprise

Artificial Intelligence • Cybersecurity • Enterprise

Gruve is an enterprise technology company that designs, builds, and operates AI-ready data center networks and delivers AI-driven solutions for businesses. The company provides Enterprise AI services (including LLM and advanced analytics deployments), AI infrastructure and GPU-rich compute environments, network automation, cybersecurity advisory and managed security services, and workload migration and platform modernization. Gruve positions itself as a provider of AI teammates, customer experience automation, and applied data strategy to help large organizations adopt and scale AI securely.

📋 Description

• Provide L2 support for Microsoft Defender alerts, incidents and service requests • Investigate endpoint detection alerts, malware detections, suspicious activities and security incidents using Microsoft Defender for Endpoint • Analyze device timelines, alert evidence, process activity and investigation data to determine incident scope • Troubleshoot Defender sensor health, onboarding, connectivity, policy application and reporting issues • Support approved threat containment and remediation activities, including device isolation and threat remediation • Investigate antivirus detection, scan failures, signature updates and endpoint protection configuration issues • Monitor endpoint protection status and coordinate remediation of Defender health and compliance gaps • Investigate escalated security alerts and determine appropriate response actions within approved procedures • Support threat hunting, incident investigation and evidence collection as required • Coordinate with SOC and L3 Security teams for complex or high-severity incidents • Execute authorized remediation actions and validate endpoint security restoration • Support vulnerability and exposure remediation activities using Microsoft security tools where applicable • Maintain incident timelines, investigation evidence and remediation records • Support Microsoft Defender portal operations, security policies and endpoint protection configurations within authorized scope • Monitor security dashboards, device risk status, protection coverage and sensor health • Support onboarding and offboarding of endpoints into Defender in coordination with Endpoint teams • Investigate security policy deviations and coordinate corrective actions with relevant teams • Support security reporting, audit evidence collection and compliance activities • Resolve security operations incidents within defined SLAs and escalation procedures • Follow Incident, Problem, Change and Security Incident Management processes • Participate in major incident response, service restoration and post-incident reviews • Maintain runbooks, investigation procedures, operational documentation and shift handover notes • Coordinate with L1/L3, SOC, Endpoint, Identity, Network and Infrastructure teams • Escalate complex threats, platform issues and incidents requiring advanced investigation to L3/SOC • Ensure effective APAC–EMEA–NLAM follow-the-sun handovers

🎯 Requirements

• 3–6 years of experience in enterprise security operations, Microsoft Defender administration, endpoint protection or security incident support • Hands-on experience with Microsoft Defender for Endpoint and its security investigation capabilities • Knowledge of endpoint protection, malware detection, threat analysis and security incident handling • Experience investigating security alerts, device timelines, suspicious processes and endpoint activity • Understanding of Defender onboarding, sensor health, security policies and endpoint protection status • Knowledge of Windows operating systems, endpoint administration and basic PowerShell • Understanding of incident severity, containment, remediation and escalation procedures • Familiarity with Microsoft Defender portal and security monitoring dashboards • Experience with ServiceNow or equivalent ITSM tools and incident management processes • Strong analytical, documentation and cross-team coordination skills • Experience in enterprise 24x7 production or security operations • Microsoft SC-200 or equivalent security operations certification (preferred) • Exposure to Microsoft Defender XDR, Microsoft Sentinel and KQL (preferred) • Knowledge of threat hunting, attack techniques and endpoint investigation (preferred) • Familiarity with Microsoft Defender for Identity and Defender for Office 365 (preferred) • Experience with vulnerability management, security compliance and incident reporting (preferred) • PowerShell scripting and security operations automation experience (preferred)

🏖️ Benefits

• Dynamic environment with strong customer and partner networks • Culture of innovation, collaboration, and continuous learning • Diverse and inclusive workplace • Equal opportunity employer

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume