TECHNICAL LEAD - MS Defender For Endpoints (EDR/ATP)

Job Description Cyber Security Engineer (L3)
EDR & NDR Specialist

Microsoft Defender for Endpoint | CrowdStrike Falcon | Darktrace

Position Summary

We are seeking an experienced SOC L3 Engineer with strong expertise in Endpoint Detection and Response (EDR) and Network Detection and Response (NDR). The role is responsible for advanced threat detection, incident investigation, threat hunting, detection engineering, and security operations support across Microsoft Defender, CrowdStrike Falcon, and Darktrace environments.

Key Responsibilities

Lead investigation and response for advanced cyber incidents including ransomware, malware, phishing, insider threats, credential compromise, and lateral movement.

Perform advanced threat hunting using Microsoft Defender, CrowdStrike Falcon, Darktrace, and SIEM platforms.

Develop and tune detection rules, analytics, and alerting logic to improve threat visibility and reduce false positives.

Conduct endpoint forensic analysis, malware triage, IOC validation, and root cause analysis.

Analyze network anomalies, east-west traffic, beaconing, data exfiltration, and unusual behavioral activities using Darktrace.

Support containment, eradication, recovery, and post-incident reviews.

Create playbooks, SOPs, and improve detection and response processes.

Mentor L1/L2 analysts and provide technical guidance during major incidents.

Coordinate with client stakeholders, security architects, IT teams, and SOC leadership.

Technical Skills

Microsoft Defender for Endpoint (MDE)

CrowdStrike Falcon EDR

Darktrace NDR

Threat Hunting & Detection Engineering

Digital Forensics & Incident Response

SIEM: Microsoft Sentinel, Splunk, QRadar, Elastic or equivalent

MITRE ATT&CK Framework

KQL, Advanced Hunting Queries, IOC Analysis

Experience

6+ years in Cyber Security/SOC Operations

3+ years hands-on experience in EDR/NDR technologies

Experience handling P1/P2 security incidents

MSSP/SOC environment experience preferred

Certifications (Preferred)

SC-200

Microsoft Defender certifications

CrowdStrike Falcon certifications

GCIA, GCIH, GCFA, CISSP, CEH

Key Competencies

Advanced Incident Response

Threat Hunting

Analytical Thinking

Stakeholder Communication

Technical Leadership

Documentation & Reporting