DTICI_CSOC_Endpoint Security Engineer_T9

Daimler Truck South East Asia; Indiana; On-site; USD 85,000 - 120,000; Full time

Job summary

Daimler Truck South East Asia seeks an hands-on Endpoint Security Analyst to join our CSOC. You will investigate incidents, analyze root causes, monitor Defender for Endpoint, and coordinate remediation with IT teams.

The role includes guiding L1/L2 analysts and contributing to post-incident RCA. Candidates should have a Bachelor's degree and 2–4 years in cybersecurity with enterprise experience.

Qualifications

• Bachelor's degree in CS/IT/Cybersecurity or equivalent experience.
• 2–4 years of cybersecurity experience with endpoint security.
• Hands-on enterprise experience with Microsoft Defender for Endpoint required.
• Experience supporting medium-severity security incidents preferred.

Responsibilities

• Investigate endpoint security incidents from detection to containment under CSOC processes.
• Perform in-depth incident analysis to determine root cause, scope, severity, and business impact.
• Monitor and analyze alerts generated from Microsoft Defender for Endpoint.
• Execute response actions such as device isolation and file quarantine.
• Escalate high-security incidents to IR with structured analysis and evidence.
• Analyze endpoint telemetry including process execution, registry changes, and network connections.
• Tune endpoint security alerts to reduce false positives and improve signal quality.
• Support endpoint hardening initiatives and ASR rules.
• Coordinate with IT for vulnerability remediation and secure configuration.
• Maintain accurate documentation for incidents and actions.
• Participate in post-incident RCA sessions and corrective actions.
• Provide guidance to L1/L2 SOC analysts on endpoint topics.
• Support audit and compliance activities related to endpoint security.

Skills

Defender for Endpoint

Microsoft Defender for Endpoint

Incident response

SOC operations

MITRE ATT&CK

Microsoft Sentinel

Telemetry analysis

Windows OS security

Vulnerability remediation

Education

Bachelor’s degree in CS/IT/Cybersecurity

Tools

Microsoft Defender for Endpoint

Microsoft Sentinel

Job description

• Investigate and respond to endpoint security incidents from detection through containment, remediation, and closure under defined CSOC processes.
• Perform in depth incident analysis to determine root cause, scope, severity, and business impact.
• Monitor and analyze alerts generated from Microsoft Defender for Endpoint
• Execute response actions such as device isolation, file quarantine, attack surface reduction actions, and indicator blocking.
• Escalate complex or high‑severity endpoint incidents to IR team with structured analysis and supporting evidence.
• Analyze endpoint telemetry including process execution, registry changes, file activity, and network connections.
• Tune and refine endpoint security alerts, detection rules, and policies to reduce false positives and improve signal quality.
• Support endpoint hardening initiatives including ASR rules, exploit protection, controlled folder access, and device control.
• Coordinate with IT teams for vulnerability remediation, patch management, and secure configuration enforcement.
• Maintain accurate documentation for incidents, investigations, and response actions.
• Participate in post‑incident reviews and RCA sessions, contributing to corrective and preventive actions.
• Provide technical guidance and knowledge sharing to L1/L2 SOC analysts on endpoint security topics.
• Support audit, compliance, and internal review activities related to endpoint security operations.

Tasks

• Investigate and respond to endpoint security incidents from detection through containment, remediation, and closure under defined CSOC processes.
• Perform in depth incident analysis to determine root cause, scope, severity, and business impact.
• Monitor and analyze alerts generated from Microsoft Defender for Endpoint
• Execute response actions such as device isolation, file quarantine, attack surface reduction actions, and indicator blocking.
• Escalate complex or high‑severity endpoint incidents to IR team with structured analysis and supporting evidence.
• Analyze endpoint telemetry including process execution, registry changes, file activity, and network connections.
• Tune and refine endpoint security alerts, detection rules, and policies to reduce false positives and improve signal quality.
• Support endpoint hardening initiatives including ASR rules, exploit protection, controlled folder access, and device control.
• Coordinate with IT teams for vulnerability remediation, patch management, and secure configuration enforcement.
• Maintain accurate documentation for incidents, investigations, and response actions.
• Participate in post‑incident reviews and RCA sessions, contributing to corrective and preventive actions.
• Provide technical guidance and knowledge sharing to L1/L2 SOC analysts on endpoint security topics.
• Support audit, compliance, and internal review activities related to endpoint security operations.

Key Skills

• Strong hands‑on experience with Microsoft Defender for Endpoint (MDE).
• Working knowledge of the Microsoft 365 Defender ecosystem, including Defender for Office 365 and Defender for Identity.
• Experience with endpoint detection, response, and remediation in enterprise environments.
• Familiarity with MITRE ATT&CK techniques related to endpoint attacks.
• Experience using SIEM platforms such as Microsoft Sentinel for alert correlation and investigation.
• Ability to analyze endpoint telemetry and identify malicious or anomalous behavior.
• Understanding of incident response lifecycle and SOC operations.
• Basic exposure to threat intelligence consumption and IOC‑based investigations.
• Solid understanding of Windows operating systems and endpoint security controls.
• Knowledge of endpoint lifecycle management, patching, and vulnerability remediation.
• Familiarity with network concepts relevant to endpoint investigations.

Qualifications

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or Engineering (or equivalent experience).
• 2–4 years of cybersecurity experience, with strong exposure to endpoint security
• Hands‑on enterprise experience with Microsoft Defender for Endpoint is mandatory.
• Experience supporting medium‑severity security incidents is strongly preferred.