L2 Operations Engineer - Malware Tools

L2 Operations Engineer - Malware Tools

Level 2 operations role for endpoint protection and malware tooling.

Support level

L2 Operations

Domain

Endpoint & Malware Protection

Scope

CrowdStrike, Windows Defender, RSA, IVQ & Phishing, Azure Key Vault

Support the clients endpoint protection and malware tools. Monitor platforms 24x7x365, resolve L2 incidents and escalate to L3 when needed.

Process

- End-to-end incident management, from L1/L1.5 escalation to closure.

- Triage, diagnose and resolve endpoint and malware incidents. Escalate to L3 with findings.

- Monitor in-scope security platforms 24x7x365.

- Raise alerts on malicious activity and intrusions by risk rating, as per client policy.

- Report security issues promptly with recommended actions.

- Install, update and maintain anti-virus and endpoint protection on client systems.

- Manage endpoint protection consoles, patching and upgrades.

- Handle phishing reports with the client security team.

- Keep ServiceNow tickets current, with clear resolution and closure notes.

- Join RCA reviews. Update SOPs and knowledge-base articles.

- Use incident trends to tune alerts and reduce repeat incidents.

- Follow client security standards and guidelines.

- Work with DLP, Hosting, Network Security and IDAM on cross-tower issues.

Tools

- CrowdStrike

- Windows Defender

- RSA

- IVQ and phishing tools

- Azure Key Vault

- ServiceNow

- Microsoft Defender for Endpoint

- SIEM(Splunk)/ SOAR tools

Technologies

- Endpoint protection: anti-virus and EDR

- Malware detection and investigation

- Phishing and mail security

- Endpoint patching and software upgrades

- Windows operating systems

- Secrets and key management

- Python or PowerShell scripting

Experience

- 12 Years of L2 endpoint security experience (to be confirmed)

- 24x7 support environment

- CrowdStrike and Windows Defender console and agent troubleshooting

- Alert triage, risk rating and escalation

- Phishing report handling

- ITSM incident, problem and change processes

- Malware investigation and containment

- Clear written and spoken English

Certifications

- CrowdStrike Falcon Administrator

- Microsoft SC-200

- CompTIA Security+