Cyber SOC Endpoint Security Engineer

Rwindia; Bengaluru; On-site; INR 800,000 - 1,200,000; Full time

Job summary

Rwindia is looking for a Cyber SOC Endpoint Security Engineer in Bengaluru, Karnataka. The ideal candidate will be responsible for monitoring and responding to security incidents, utilizing tools like Microsoft Defender for Endpoint. You will conduct investigations, perform root cause analyses, and support endpoint security operations. Qualifications include a cybersecurity background with experience in incident response and familiarity with security frameworks. Strong communication skills and a collaborative mindset are essential. Join us to enhance our security posture.

Qualifications

• 2–4 years of experience in cybersecurity with endpoint security exposure.
• Hands-on experience with Microsoft Defender for Endpoint (mandatory).
• Knowledge of Microsoft 365 Defender.
• Familiarity with MITRE ATT&CK framework.

Responsibilities

• Investigate and respond to endpoint security incidents.
• Monitor and analyze alerts from Microsoft Defender for Endpoint.
• Perform root cause analysis and impact assessment.
• Execute response actions like device isolation and threat containment.
• Provide guidance to L1/L2 SOC analysts.

Skills

Cybersecurity experience

Microsoft Defender for Endpoint

Endpoint detection and response

Incident response lifecycle understanding

SIEM tools experience

Networking concepts

Tools

Microsoft Sentinel

Job description

Job Summary

The Cyber SOC Endpoint Security Engineer is responsible for monitoring, analyzing, and responding to endpoint security incidents using Microsoft Defender tools. The role focuses on endpoint detection, investigation, containment, and remediation while improving overall security posture and supporting SOC operations.

Key Responsibilities

• Investigate and respond to endpoint security incidents through the full lifecycle (detection to closure).
• Monitor and analyze alerts from Microsoft Defender for Endpoint.
• Perform root cause analysis, impact assessment, and incident classification.
• Execute response actions such as device isolation, file quarantine, and threat containment.
• Escalate high-severity incidents with proper analysis and documentation.
• Analyze endpoint telemetry (processes, registry, files, network activity).
• Tune detection rules and reduce false positives.
• Support endpoint hardening and security control implementations.
• Collaborate with IT teams for patching, vulnerability remediation, and configuration.
• Maintain documentation and participate in post-incident reviews (RCA).
• Provide guidance to L1/L2 SOC analysts and support audit/compliance activities.

Required Skills & Experience

• 2–4 years of experience in cybersecurity with endpoint security exposure.
• Hands-on experience with Microsoft Defender for Endpoint (mandatory).
• Knowledge of Microsoft 365 Defender (Defender for Office 365, Defender for Identity).
• Experience in endpoint detection and response (EDR).
• Familiarity with MITRE ATT&CK framework.
• Experience with SIEM tools like Microsoft Sentinel.
• Strong understanding of incident response lifecycle and SOC operations.
• Knowledge of Windows OS and endpoint security controls.
• Understanding of patching, vulnerability management, and endpoint lifecycle.
• Basic knowledge of networking concepts.

Preferred Qualifications

• Experience handling medium to high severity incidents.
• Exposure to threat intelligence and IOC-based investigations.
• Strong analytical and problem-solving skills.

Other Requirements

• Ability to work in a collaborative SOC environment.
• Strong documentation and communication skills.
• Willingness to continuously learn and adapt to evolving threats.