CrowdStrike EDR

Wipro; Hyderabad, Pune District, Bengaluru; On-site; INR 1,200,000 - 1,800,000; Full time

Job summary

Wipro Hyderabad is seeking an EDR consultant to integrate endpoint detection and response across the organization’s security operations. The role focuses on triage, investigation, and collaboration with SOC analysts to tune detection rules and playbooks for proactive threat handling.

The candidate will contribute to EDR policy creation, perform threat analysis, and mentor junior staff while continuously improving detection capabilities and response procedures.

Qualifications

• Experience implementing and operating EDR solutions.
• Ability to collaborate with SOC teams for triage and response.
• Proficiency in creating playbooks, SOPs, and runbooks for EDR operations.

Responsibilities

• Integrate EDR into security operations and coordinate with SOC.
• Analyze threats and contribute to EDR policy and detection criteria.
• Develop detection rules based on IOCs and behavior patterns.
• Investigate incidents, define data collection and correlation procedures.
• Monitor EDR performance and optimize policies and rules.
• Mentor junior analysts and conduct EDR training.
• Regularly update EDR policy with lessons learned.

Skills

EDR expertise

SOC coordination

Threat analysis

Incident investigations

Detection rules

Policy development

Mentoring

Training sessions

SIEM integration

Tools

SIEM

ITSM

EDR Console

Job description

Job Description:-

• 1. Integrate EDR capabilities into the broader security operations of the organization. Collaborate with SOC analysts to ensure seamless coordination and communication between EDR alerts and SOC workflows. Contribute to the development of playbooks, runbooks, and standard operating procedures (SOPs) that enable SOC analysts to effectively triage, investigate, and respond to EDR alerts.
• 2. Analyze emerging cyber threats and trends. Contribute to EDR policy creation by providing insights into the latest attack techniques, malware variants, and threat actor tactics, techniques, and procedures (TTPs). This information informs the development of detection criteria and response procedures within the EDR policy.
• 3. Leverage technical expertise to develop detection rules and signatures for the EDR solution. Design rules based on known Indicators of Compromise (IOCs), behavioral anomalies, and attack patterns to enhance the EDR solutions ability to identify malicious activity on endpoints. Ensure that detection rules are accurate, efficient, and tuned to minimize false positives.
• 4. Conduct in-depth investigations to determine the scope, impact, and root cause of incidents. Contribute to EDR policy creation by defining procedures for incident investigation, including data collection, analysis, and correlation across multiple endpoints. Identify gaps in detection capabilities and recommend enhancements to the EDR policy based on lessons learned from incident investigations.
• 5. Continuously monitor the performance of the EDR solution and assess its effectiveness in detecting and responding to threats. Collaborate with other security team members to optimize EDR policies, fine-tune detection rules, and adjust response procedures based on real-world observations and feedback.
• 6. Provide mentorship and guidance to junior analysts and IT staff involved in EDR operations. Conduct training sessions, workshops, and knowledge sharing sessions to enhance the skills and expertise of the security team members. Empower others to understand and adhere to the EDR policy, fostering a culture of security awareness and collaboration within the organization.
• 7. Regularly review and update the EDR policy to incorporate lessons learned from incidents and changes in the threat landscape. This ensures the policy remains current and effective in addressing emerging cybersecurity challenges.

Roles&Responsibilities :-

• 1. Install, configure, and maintain EDR software across the organization’s endpoints. Create the necessary packages for EDR client installation.
• 2. Developing and implementing security policies and procedures related to Endpoint security. Enable the different policy like Anti Malware, Behavioral, Device control on EDR as per the best security practice.
• 3. Proactive searching for signs of Compromise or emerging threats
• 4. Ensuring endpoints are up to date with security patches and update the platform and agents to minimize vulnerabilities.
• 5. Level 3 Troubleshoot for failed installation not resolved by the L2 engineer.
• 6. Provide regular updates and reports on security incidents, compliance report, deployment status, issues encountered.
• 7. Configuring the necessary policies and exceptions on EDR console including group assignment rules based on the host name, IPs, domain name, etc. Finetune the policy based on alerts triggered for the deployed endpoints and performance issues observed during installation.
• 8. Integration of EDR with SIEM, ITSM and other tools

Additional EDR implementation Roles & Responsibilities from the one given above.

• 1) Assessing the organization existing endpoint, understanding the requirements, and planning the deployment of EDR solutions
• 2) Perform the POC of the different policies and installation on different OS.
• 3) Create design document, policy document, prerequisite installation document guide.

Roles and Responsibilities for EDR consultant

• 1) Assessing the organization existing endpoint, understanding the requirements, and planning the deployment of EDR solutions
• 2) Providing Guidance on vendor selection, negotiation, and management of EDR solutions
• 3) Provide expert recommendations on the selection, implementation of the EDR solutions.
• 4) Offer technical expertise and guidance on EDR capabilities, features as per best security practice.
• 5) Developing and implementing security policies and procedures related to Endpoint security. Enable the different policy like Anti Malware, Behavioral, Device control on EDR as per the best security practice.