Senior Endpoint Detection Specialist

Coffee Chat; Abu Dhabi; Remote; AED 150,000 - 270,000; Full time

Job summary

Coffee Chat is seeking an experienced Senior Endpoint Detection Specialist to design, administer, optimize, and maintain endpoint detection and response capabilities across the enterprise. The role emphasizes detecting, investigating, analyzing, and responding to endpoint threats, with collaboration across Security Operations, Infrastructure, Cloud, and IAM teams.

The ideal candidate brings hands-on experience with enterprise endpoint security platforms, telemetry, attack behavior analysis, SIEM

Qualifications

• Hands-on experience with enterprise endpoint security platforms, endpoint telemetry, attack behavior analysis, SIEM integration, threat intelligence, and established cybersecurity frameworks.

Responsibilities

• Administer, monitor, and optimize endpoint detection and response platforms across IT environments.
• Monitor and triage endpoint security alerts from EDR, antivirus, and related monitoring tools.
• Conduct threat hunting and advanced endpoint analysis to identify malicious behavior not detected by existing alerts.
• Design, develop, and tune endpoint detection rules and behavior analytics across the MITRE ATT&CK framework.
• Investigate suspected malware infections and perform analysis using approved tools and isolation environments.

Skills

Endpoint security platforms

Endpoint telemetry

Attack behavior analysis

SIEM integration

Threat intelligence

Cybersecurity frameworks

Tools

KQL / NQL

SQL

Sigma

Job description

We're Hiring: Senior Endpoint Detection Specialist

Location: United Arab Emirates (Remote)

Employment Type: Full-Time

Experience Level: Mid-Level to Senior

Work Arrangement: Fully Remote

About Us

We are a construction-focused organization committed to delivering complex projects through operational excellence, effective risk management, secure technology infrastructure, and collaborative project delivery. Our distributed teams work across Project Management, Construction, Engineering, Procurement, Commercial, Legal, Finance, Human Resources, Design, Quality, HSE, Consultants, Contractors, Suppliers, Logistics, Administration, Information Technology, and Executive Leadership to support business continuity, protect sensitive information, and maintain reliable digital operations.

As our technology environment continues to evolve, endpoint security plays a critical role in protecting corporate devices, project systems, remote workforces, and business-critical information against increasingly sophisticated cyber threats. We value professionals who combine strong technical expertise, analytical thinking, proactive threat detection, and disciplined incident handling to strengthen our security posture and reduce operational risk.

The Role

We are seeking an experienced Senior Endpoint Detection Specialist to design, administer, optimize, and maintain endpoint detection and response capabilities across the organization's enterprise environment. The successful candidate will be responsible for detecting, investigating, analyzing, and responding to suspicious endpoint activity, malicious processes, advanced persistent threats, ransomware, malware infections, credential theft, and other endpoint-related security incidents.

This role will focus on endpoint detection and response (EDR), endpoint telemetry analysis, threat hunting, detection engineering, security alert triage, incident investigation, and continuous improvement of endpoint security controls. The specialist will collaborate with Security Operations, Incident Response, Infrastructure, Network, Cloud, Identity and Access Management, Application Support, and other technology teams to improve detection coverage, accelerate incident containment, and protect corporate workstations, servers, virtual desktops, cloud workloads, and other managed endpoints.

The ideal candidate will bring hands-on experience with enterprise endpoint security platforms, endpoint telemetry, attack behavior analysis, security information and event management (SIEM) integration, threat intelligence, and established cybersecurity frameworks. The role requires a proactive approach to identifying security weaknesses, reducing false positives, improving detection accuracy, and ensuring that endpoint threats are investigated and addressed promptly.

Key Responsibilities

1. Endpoint Detection and Response Management

• Administer, configure, monitor, and optimize enterprise endpoint detection and response platforms across supported IT environments.
• Maintain endpoint security coverage across corporate workstations, laptops, servers, virtual desktops, remote devices, and supported cloud workloads.
• Deploy and maintain endpoint detection agents, sensors, and associated security components in accordance with approved deployment procedures.
• Monitor endpoint agent health, connectivity, policy compliance, telemetry ingestion, and detection functionality.
• Investigate endpoints with missing agents, outdated security components, disabled protections, reporting failures, or incomplete monitoring coverage.
• Maintain an accurate inventory of protected endpoints, operating systems, device ownership, security status, and assigned protection policies.
• Configure endpoint protection policies based on device type, operating system, business criticality, risk exposure, and operational requirements.
• Enforce appropriate endpoint security controls, including behavioral monitoring, malicious process detection, exploit prevention, and ransomware protection.
• Support endpoint isolation, process termination, file quarantine, and other authorized containment actions when required.
• Ensure endpoint security policies remain aligned with organizational standards, risk tolerance, and approved security architecture.
• Evaluate new platform capabilities and recommend improvements to detection, response, investigation, and reporting functions.
• Coordinate platform upgrades, configuration changes, agent updates, and policy deployments through established change management procedures.

2. Security Alert Monitoring and Triage

• Review, prioritize, and investigate endpoint security alerts generated by EDR, antivirus, endpoint protection, and related monitoring technologies.
• Assess alerts involving suspicious processes, malicious files, unauthorized scripts, unusual network connections, persistence mechanisms, and privilege escalation.
• Analyze alert context, including endpoint identity, user activity, process ancestry, command-line arguments, file hashes, network indicators, and execution timelines.
• Distinguish genuine threats from benign administrative activity, legitimate software behavior, and false-positive detections.
• Correlate endpoint alerts with SIEM events, identity logs, network telemetry, email security findings, and cloud security signals.
• Determine the severity, scope, and potential business impact of suspected endpoint compromises.
• Identify recurring alerts, detection gaps, and patterns that may indicate coordinated or repeated attack activity.
• Escalate critical and high-severity incidents in accordance with incident response procedures and established service-level agreements.
• Maintain clear investigation notes, alert classifications, supporting evidence, and recommended remediation actions.
• Ensure alerts are resolved, escalated, or tracked through the appropriate security case management workflow.

3. Threat Hunting and Advanced Endpoint Analysis

• Conduct proactive threat-hunting activities to identify malicious behavior that may not trigger existing security alerts.
• Develop and execute hypothesis-driven hunts using endpoint telemetry, threat intelligence, behavioral indicators, and known adversary techniques.
• Investigate suspicious PowerShell execution, command-line activity, script interpreters, scheduled tasks, registry modifications, and other potential attack behaviors.
• Analyze process trees, parent-child process relationships, loaded modules, file activity, authentication events, and network connections.
• Search for indicators of compromise, including suspicious file hashes, domains, IP addresses, persistence artifacts, and malicious execution patterns.
• Investigate potential ransomware activity, credential dumping, lateral movement, unauthorized remote access, and command-and-control communications.
• Examine suspicious binaries and scripts using approved static analysis, sandboxing, and behavioral analysis tools.
• Identify endpoint artifacts associated with phishing-based compromise, drive-by downloads, malicious attachments, and exploitation attempts.
• Investigate anomalous endpoint behavior that may indicate insider threats, unauthorized software use, or policy violations.
• Develop repeatable threat-hunting queries and document the methodology, findings, and recommended improvements.
• Share actionable findings with Security Operations, Threat Intelligence, and Incident Response teams to improve organizational detection capabilities.
• Support retrospective investigations to identify additional compromised endpoints following the discovery of a significant security incident.

4. Detection Engineering and Rule Optimization

• Design, develop, test, deploy, and maintain endpoint detection rules, behavioral analytics, and threat detection logic.
• Translate threat intelligence, incident findings, and observed attack techniques into actionable endpoint detections.
• Develop detection logic for suspicious process execution, persistence, credential access, defense evasion, privilege escalation, and lateral movement.
• Use relevant query languages and detection formats, such as Kusto Query Language (KQL), Structured Query Language (SQL), platform-specific search languages, and Sigma where applicable.
• Map detection use cases to the MITRE ATT&CK framework to identify coverage gaps and improve visibility across adversary tactics and techniques.
• Validate detection rules using controlled testing, approved simulation tools, and representative endpoint telemetry.
• Tune alert thresholds, exclusions, behavioral policies, and correlation logic to reduce false positives without weakening meaningful security coverage.
• Maintain detection rule documentation, ownership, version history, test results, and change records.
• Review detection effectiveness following security incidents, threat intelligence updates, platform changes, and changes in the organization's technology environment.
• Collaborate with SIEM and Security Operations teams to improve cross-platform correlation and investigation workflows.
• Identify opportunities to automate repetitive detection validation, enrichment, alert classification, and response activities.
• Establish quality standards for detection development, including accuracy, coverage, maintainability, and operational usefulness.

5. Malware Analysis and Threat Investigation

• Investigate suspected malware infections, suspicious executables, malicious scripts, and potentially unwanted applications.
• Analyze file hashes, digital signatures, file metadata, execution behavior, persistence mechanisms, and related endpoint artifacts.
• Assess malware delivery methods, execution chains, payload behavior, and potential impact on affected systems.
• Identify indicators associated with trojans, ransomware, spyware, remote access tools, loaders, and other malicious software.
• Use approved malware analysis tools and isolated environments to examine suspicious samples safely.