Endpoint Security Operations Engineer (L2) – Microsoft Defender

Accountabilities: Provide L2 operational support for Microsoft Defender alerts, incidents, and service requests. Investigate endpoint detection alerts, malware detections, suspicious activity, and security incidents using Microsoft Defender for Endpoint. Analyze device timelines, alert evidence, process activity, and investigation data to assess the scope and potential impact of threats. Troubleshoot Defender sensor health, endpoint onboarding, connectivity, policy application, reporting, antivirus scans, and signature updates. Support approved threat containment and remediation actions, including device isolation and validation of endpoint security restoration. Assist with threat hunting, evidence collection, vulnerability remediation, and escalated security investigations in coordination with SOC and L3 teams. Monitor endpoint protection coverage, device risk status, security dashboards, and compliance gaps; coordinate corrective actions with relevant teams. Support endpoint onboarding and offboarding in Defender, security policy administration, audit evidence collection, and compliance reporting. Manage incidents within defined SLAs and follow established incident, problem, change, and security incident management procedures. Participate in major incident response, service restoration, and post-incident reviews. Maintain investigation records, incident timelines, runbooks, operational documentation, and shift handover notes. Coordinate with L1/L3 operations, SOC, Endpoint, Identity, Network, and Infrastructure teams, escalating complex threats and platform issues appropriately. Ensure effective follow-the-sun operational handovers across APAC, EMEA, and North America. Requirements: 3–6 years of experience in enterprise security operations, Microsoft Defender administration, endpoint protection, or security incident support. Hands-on experience with Microsoft Defender for Endpoint and its alert investigation and security response capabilities. Strong understanding of endpoint protection, malware detection, threat analysis, and security incident handling. Experience investigating security alerts, device timelines, suspicious processes, and endpoint activity. Knowledge of Defender onboarding, sensor health, security policies, endpoint protection configurations, and device compliance. Good understanding of Windows operating systems, endpoint administration, and basic PowerShell. Familiarity with incident severity assessment, containment, remediation, and escalation procedures. Experience using the Microsoft Defender portal and security monitoring dashboards. Familiarity with ServiceNow or equivalent IT service management tools and incident management workflows. Experience working in enterprise production environments or 24/7 security operations. Strong analytical, troubleshooting, documentation, communication, and cross-functional coordination skills. Preferred: Microsoft SC-200 or an equivalent security operations certification. Preferred: Exposure to Microsoft Defender XDR, Microsoft Sentinel, KQL, threat hunting, and endpoint investigation techniques. Preferred: Familiarity with Microsoft Defender for Identity, Defender for Office 365, vulnerability management, and security compliance. Preferred: Experience with PowerShell scripting and security operations automation. Benefits: Remote working arrangement within India. Opportunity to work with Microsoft security technologies and enterprise endpoint protection environments. Exposure to global security operations and collaboration across international teams. Professional development through hands-on experience in threat investigation, incident response, and endpoint security. Collaborative environment focused on innovation, continuous learning, and inclusive teamwork. Salary, healthcare coverage, insurance, paid leave, and additional benefits are not specified in the job description.