EDR and Cloud security support (Endpoint security)

Atos; Cyberjaya; On-site; MYR 120,000 - 180,000; Full time

Job summary

Atos in Malaysia’s Cyberjaya is seeking an experienced EDR/XDR security engineer to monitor, investigate, and respond to endpoint and cloud threats within defined SLAs.

You will detect, triage, and remediate security incidents across Microsoft Defender for Endpoint, Defender XDR, Defender for Cloud, and cloud platforms (Azure/AWS/GCP), coordinating with SOC and infrastructure teams to improve security posture.

Qualifications

• 3–5+ years in EDR, endpoint security, cloud security, or SOC operations.
• Hands-on with Defender for Endpoint, Defender XDR, or equivalent EDR/XDR platform.
• Understanding of endpoint telemetry and investigation techniques.
• Experience investigating malware, ransomware and suspicious activity.
• Good understanding of Azure security and Entra ID, Defender for Cloud, IAM, and logging.
• Ability to troubleshoot and conduct security investigations.
• Familiarity with incident management, escalation, and SLA processes.

Responsibilities

• Monitor and investigate EDR/XDR alerts and incidents.
• Perform endpoint investigations covering processes, files, hashes, network connections, and user activity.
• Investigate malware, ransomware, PowerShell activity, persistence, lateral movement, and credential-related activity.
• Perform endpoint isolation, remediation, and approved response actions.
• Review endpoint health, sensor status, and protection status.
• Troubleshoot EDR agent deployment, connectivity, policy, and telemetry issues.
• Coordinate with SOC, infrastructure, and endpoint teams for remediation.
• Track unresolved EDR issues and ensure SLA-based closure.
• Monitor and investigate security alerts across Azure, AWS, and GCP.
• Support Defender for Cloud and cloud security monitoring.
• Investigate suspicious cloud authentication and activity; monitor posture and configurations.
• Coordinate remediation with cloud and platform teams; assist with incident response and root-cause analysis.

Skills

EDR/XDR security

Endpoint security

Cloud security

SOC operations

Incident investigation

Threat hunting

Tools

Microsoft Defender for Endpoint

Defender XDR

Microsoft Defender for Cloud

Microsoft Sentinel

Job description

Responsible for monitoring, administration, troubleshooting, investigation, and operational support of EDR/XDR and cloud security platforms. The role ensures endpoint and cloud threats are detected, investigated, escalated, and remediated within defined service-level agreements.

Key Responsibilities

• Monitor and investigate EDR/XDR alerts and incidents.
• Perform endpoint investigations covering processes, command lines, files, hashes, network connections, and user activity.
• Investigate malware, ransomware, suspicious PowerShell activity, persistence, lateral movement, and credential-related activity.
• Perform endpoint isolation, remediation, and other approved response actions.
• Review endpoint health, sensor or agent status, and protection status.
• Troubleshoot EDR agent deployment, connectivity, policy, and telemetry issues.
• Support EDR policy configuration, exclusions, and alert tuning.
• Coordinate with SOC, infrastructure, and endpoint teams to complete remediation.
• Track unresolved EDR issues and ensure closure within agreed SLAs.
• Monitor and investigate security alerts across Azure, AWS, and GCP, as applicable.
• Support Microsoft Defender for Cloud and broader cloud security monitoring.
• Investigate suspicious cloud authentication, privilege escalation, resource changes, and anomalous activity.
• Monitor cloud security posture, recommendations, security alerts, identities, network activity, resources, and security configurations.
• Support investigations involving Microsoft Entra ID identity and authentication events.
• Coordinate remediation of cloud security findings with cloud and platform teams.
• Assist with cloud security incident response and root-cause analysis.
• Support cloud security logging and integration with SIEM platforms.

Required Qualifications and Experience

• 3–5+ years of experience in EDR, endpoint security, cloud security, or SOC operations.
• Hands‑on experience with Microsoft Defender for Endpoint, Defender XDR, or an equivalent EDR/XDR platform.
• Good understanding of endpoint telemetry and investigation techniques.
• Experience investigating malware, ransomware, suspicious PowerShell activity, suspicious processes, and endpoint compromise.
• Good understanding of Azure security and Microsoft Entra ID.
• Working knowledge of Microsoft Defender for Cloud.
• Good understanding of cloud identity and access management, networking, security controls, and logging.
• Ability to perform technical troubleshooting and security investigations.
• Good understanding of incident management, escalation, and SLA processes.

Preferred Qualifications

• Experience with AWS or GCP security.
• Knowledge of Defender for Identity, Defender Vulnerability Management, and Microsoft Intune.
• Experience with Microsoft Sentinel and Kusto Query Language.
• Knowledge of cloud security posture management and cloud workload protection platform concepts.
• Experience with EDR platforms such as Trellix, CrowdStrike, SentinelOne, or Palo Alto Cortex XDR.
• Knowledge of MITRE ATT&CK and threat hunting.
• Understanding of cloud security frameworks and CIS benchmarks.

Preferred Certifications

SC-200, AZ-500, AZ-104, GCIH, or CompTIA Security+.

Key Success Measures

• Timely investigation and resolution of EDR and cloud security alerts.
• Improved endpoint and cloud security health and coverage.
• SLA compliance for security incidents and technical issues.
• Reduction in recurring endpoint and cloud security incidents.
• Timely remediation of cloud security findings.
• Effective coordination with SOC, cloud, infrastructure, and endpoint teams.
• Continuous improvement of the overall EDR and cloud security posture.