Specialist Endpoint Security

Cpx Affiliate; Abu Dhabi; On-site; AED 180,000 - 240,000; Full time

Job summary

Cpx Affiliate in Abu Dhabi is seeking an experienced Endpoint Security Engineer to protect the organization\'s endpoint estate, monitor EDR/XDR detections, and support containment and remediation of threats. The role requires hands-on work across Windows, macOS and Linux, and close collaboration with SOC and ITSM processes.

You will maintain secure configurations, tune policies to reduce false positives, and coordinate remediation of vulnerabilities.

Qualifications

• Minimum 5 years of experience in endpoint security operations or similar cybersecurity role.
• Bachelor's degree in cybersecurity, information security, CS, IT, or related field.
• Hands-on exposure to EDR/XDR monitoring, incident investigation, and containment.
• Certs such as CompTIA Security+, SC-200, MD-102, Trend Micro or CyberArk certs; ITIL Foundation is advantageous.

Responsibilities

• Monitor and investigate alerts across Trend Micro AV, Trend Micro XDR, DDI, IPS, Forcepoint, Netskope for malware and endpoint compromise.
• Correlate endpoint, network, web, cloud, and identity-security events to determine severity, scope, assets and escalation.
• Perform initial investigations by reviewing processes, network connections, and IOC indicators.
• Administer and support endpoint agents and policies, including deployment, health, updates, and tamper protection.
• Maintain coverage across Windows, macOS, Linux, and VDI; identify unmanaged or non-reporting assets and coordinate remediation.
• Review configurations and exceptions to ensure risk-based authorization and alignment with standards.
• Coordinate remediation of endpoint vulnerabilities and security misconfigurations; track actions to closure.

Skills

EDR/XDR monitoring

Endpoint security operations

Incident investigation

Containment

Policy administration

ITSM workflows

CyberArk

Trend Micro AV

Trend Micro XDR

Netskope

Education

Bachelor's degree in Cybersecurity, Information Security, Computer Science, or related discipline

Tools

CyberArk

Trend Micro AV

Trend Micro XDR

DDI / Deep Discovery Inspector

TippingPoint IPS

Forcepoint

Netskope

Job description

Job Purpose :-

To protect the organization's endpoint estate by operating endpoint security controls, monitoring and investigating EDR/XDR detections, and supporting the containment and remediation of cyber threats. The role maintains secure configurations across Windows, macOS, and Linux endpoints, strengthens endpoint hardening and compliance, supports vulnerability and attack-surface reduction activities, and correlates endpoint, network, web, cloud, and privileged-access telemetry through established SOC, incident response, and ITSM processes.

Primary Responsibilities: -

Endpoint Threat Monitoring & Investigation

• Monitor and investigate alerts across Trend Micro AV, Trend Micro XDR, Deep Discovery Inspector (DDI), TippingPoint IPS, Forcepoint, and Netskope for malware, suspicious behavior, exploit activity, credential threats, malicious network activity, and potential endpoint compromise.
• Correlate endpoint, network, web, cloud, and identity-security events using telemetry from Trend Micro AV/XDR, DDI, TippingPoint IPS, Forcepoint, Netskope, CyberArk, SIEM, and threat intelligence to determine severity, scope, affected assets, and required escalation
• Perform initial investigations by reviewing process trees, file and hash details, network connections, user activity, device history, privileged-account activity, and related indicators of compromise.
• Administer and support endpoint security agents and policies, with primary hands-on experience in Trend Micro AV and Trend Micro XDR, including deployment, health monitoring, policy assignment, signature and engine updates, tamper protection, exclusions, and agent upgrades.
• Maintain security coverage across Windows, macOS, Linux, VDI, and approved server endpoints; identify unmanaged, disconnected, unhealthy, or non-reporting assets and coordinate remediation.
• Review endpoint security configurations and exceptions to ensure they are authorized, risk-assessed, time-bound, documented, and aligned with security standards.
• Tune prevention and detection policies to strengthen security effectiveness while minimizing false positives and operational disruption.

Incident Response & Containment : -

• Execute approved containment actions under SOC/IR guidance, including host isolation, malicious process termination, file quarantine, indicator blocking, privileged-account suspension through CyberArk processes, account disablement, forced sign-outs, and session or token revocation.
• Support evidence preservation, malware eradication, recovery validation, and post-incident monitoring while maintaining a clear chain of actions and incident timeline.
• Assess endpoint compliance against approved security baselines, encryption requirements, host firewall policies, application control, device control, and attack-surface reduction rules.
• Coordinate remediation of endpoint vulnerabilities and security misconfigurations, validate corrective actions, and track exceptions or overdue items to closure.
• Collaborate with SOC, incident response, PAM/IAM, network security, vulnerability management, infrastructure, workplace technology, and application teams. Support investigations and control validation involving CyberArk, DDI, TippingPoint IPS, Forcepoint, and Netskope.

Minimum Work Experience & Education : -

• Minimum 5 years of experience in endpoint security operations, endpoint protection engineering, SOC operations, or a similar cybersecurity role, including hands-on exposure to EDR/XDR monitoring, incident investigation, and containment.
• Bachelor's degree in Cybersecurity, Information Security, Computer Science, Information Technology, or a related discipline.

Skills / Certifications : -

• Hands-on experience with endpoint and enterprise security technologies, including CyberArk; Trend Micro AV; Trend Micro XDR; Deep Discovery Inspector (DDI); TippingPoint IPS; Forcepoint; and Netskope. Strong knowledge of EDR/XDR alert triage, malware analysis, endpoint containment and remediation, policy administration, endpoint hardening, vulnerability remediation, attack-surface reduction, encryption, host firewall, application and device control, and ITSM/security case-management workflows such as ServiceNow.
• Relevant certifications include CompTIA Security+, SC-200, MD-102, Trend Micro or CyberArk product certification, or equivalent security-operations credentials; ITIL Foundation is advantageous.