TECHNICAL LEAD - MS Defender For Endpoints (EDR/ATP)

Happiest Minds Technologies; Bengaluru; On-site; INR 2,600,000 - 4,200,000; Full time

Job summary

Happiest Minds Technologies seeks an experienced SOC L3 Engineer with deep expertise in EDR and NDR. You will lead investigations, threat hunting, and detection engineering across Microsoft Defender for Endpoint, CrowdStrike Falcon, and Darktrace environments.

You will mentor junior analysts, coordinate with client stakeholders, and develop playbooks to improve detection and response. 6+ years in cyber security, MSSP/SOC exposure, and relevant certifications are preferred.

Qualifications

• 6+ years in Cyber Security/SOC Operations.
• Hands-on experience with EDR/NDR technologies.
• Experience handling P1/P2 security incidents.
• MSSP/SOC environment experience preferred.

Responsibilities

• Lead investigation and response for advanced cyber incidents including ransomware and phishing.
• Perform advanced threat hunting using EDR/NDR tools and SIEM platforms.
• Develop and tune detection rules, analytics, and alerting logic.
• Conduct endpoint forensics, IOC validation and root cause analysis.
• Coordinate with clients and SOC leadership during major incidents.
• Create playbooks, SOPs, and mentor L1/L2 analysts.

Skills

Threat hunting

Incident investigation

SOC operations

Mentoring juniors

Tools

Microsoft Defender for Endpoint

CrowdStrike Falcon EDR

Darktrace NDR

SIEM (Microsoft Sentinel, Splunk, QRadar, Elastic)

KQL / Advanced Hunting

Job description

Note: Looking for Immediate to 15 Days Joiners only

EDR & NDR Specialist - Cyber Security Engineer (L3)

• Microsoft Defender for Endpoint | CrowdStrike Falcon | Darktrace

  Position Summary

  We are seeking an experienced SOC L3 Engineer with strong expertise in Endpoint Detection and Response (EDR) and Network Detection and Response (NDR). The role is responsible for advanced threat detection, incident investigation, threat hunting, detection engineering, and security operations support across Microsoft Defender, CrowdStrike Falcon, and Darktrace environments.

  Key Responsibilities

• Lead investigation and response for advanced cyber incidents including ransomware, malware, phishing, insider threats, credential compromise, and lateral movement.
• Perform advanced threat hunting using Microsoft Defender, CrowdStrike Falcon, Darktrace, and SIEM platforms.
• Develop and tune detection rules, analytics, and alerting logic to improve threat visibility and reduce false positives.
• Conduct endpoint forensic analysis, malware triage, IOC validation, and root cause analysis.
• Analyze network anomalies, east-west traffic, beaconing, data exfiltration, and unusual behavioral activities using Darktrace.
• Support containment, eradication, recovery, and post-incident reviews.
• Create playbooks, SOPs, and improve detection and response processes.
• Mentor L1/L2 analysts and provide technical guidance during major incidents.

• Coordinate with client stakeholders, security architects, IT teams, and SOC leadership.

  Technical Skills

• Microsoft Defender for Endpoint (MDE)
• CrowdStrike Falcon EDR
• Darktrace NDR
• Threat Hunting & Detection Engineering
• Digital Forensics & Incident Response
• SIEM: Microsoft Sentinel, Splunk, QRadar, Elastic or equivalent
• MITRE ATT&CK Framework

• KQL, Advanced Hunting Queries, IOC Analysis

  Experience

• 6+ years in Cyber Security/SOC Operations
• 3+ years hands-on experience in EDR/NDR technologies
• Experience handling P1/P2 security incidents

• MSSP/SOC environment experience preferred

  Certifications (Preferred)

• SC-200
• Microsoft Defender certifications
• CrowdStrike Falcon certifications
• GCIA, GCIH, GCFA, CISSP, CEH

• Key Competencies

• Advanced Incident Response
• Threat Hunting
• Analytical Thinking
• Stakeholder Communication
• Technical Leadership
• Documentation & Reporting