Cyber Defense Engineering II - Endpoint Protection

Overview

Join the Cyber Defense Engineering Endpoint Protection team to support senior colleagues in configuring and maintaining endpoint security controls, with the goal of 100% endpoint security agent deployment, visibility and control enforcement compliance across the enterprise.

What you'll do

• Deploy, update and troubleshoot endpoint security agents across Windows, Linux and macOS environments, working with Cyber Defense, Desktop, Server, Cloud Compute and other technology teams.
• Assist in driving enterprise-wide deployments and migrations of next-generation AV / EDR controls, ensuring consistent coverage during transition periods.
• Assist with configuration and maintenance of endpoint security policies, including prevention, detection and response, device control, security content updates, exclusions, network containment and host-based firewall rules.
• Proactively identify and resolve non-compliant compute endpoints with unhealthy endpoint security agent states.
• Take ownership of Tier 1/2 operational support requests and incidents in the Cyber Defense Engineering - Endpoint Protection ticket queue.
• Work with system owners to configure and maintain narrowly defined AV / EDR exclusions that prevent false positives without creating security gaps, while ensuring system performance.
• Maintain the team's internal knowledgebase, including documentation pages and standard operating procedures (SOPs) for endpoint security agent and platform management.

What you'll need

• Bachelor's degree in Cybersecurity, Computer Science or a related technical field, or 2-4 years of equivalent hands-on experience in IT security, systems support or engineering related roles.
• Strong grasp of Windows, Mac and Linux operating system internals, command-line usage and log analysis.
• Basic proficiency in at least two common scripting languages (e.g. PowerShell for Windows, Bash for Linux/macOS, Python for cross-platform support).
• Understanding of networking fundamentals including TCP/IP and DNS, including how endpoint security agents communicate with cloud-based cybersecurity platforms.
• Foundational IT security certification (e.g. CompTIA Security+).
• Strong communication skills and ability to work effectively with other teams and system owners to enforce endpoint security control compliance.
• Critical thinking for issue and incident triage and root-cause analysis (e.g. troubleshooting endpoint security agent health issues).
• Ability to balance day-to-day operational support and ticket queues with long-term, enterprise-wide platform maturity efforts.

Nice to have

• Endpoint security administration oriented certifications.
• Hands-on experience supporting enterprise-grade cybersecurity and/or IT systems management platforms and controls at scale.
• Working knowledge of one or more SIEM query languages for querying endpoint telemetry data (e.g. SPL, KQL, CQL, or UDM Search/YARA-L).
• Practical experience using cybersecurity and/or IT systems management platform APIs for script development (e.g. report generation and workflow automation).

Details

• Location: Bangalore - Bagmane Tridib.