L2 Endpoint Security Engineer - Microsoft Defender Expert

Gruve; San Francisco (CA); In loco; USD 90.000 - 130.000; Tempo pieno

Descrizione del lavoro

Gruve in San Francisco seeks an experienced L2 System Administrator to support Microsoft Defender security operations across enterprise endpoints and infrastructure. You will investigate alerts, analyze endpoint threats and troubleshoot Defender issues to ensure rapid containment and remediation.

You will coordinate with SOC, L3 and Endpoint teams to drive incident response, policy compliance and stable Defender health.

Competenze

• 3–6 years of experience in enterprise security operations or security incident support.
• Hands-on experience with Microsoft Defender for Endpoint and its investigation capabilities.
• Knowledge of endpoint protection, malware detection and threat analysis.
• Experience investigating security alerts, device timelines and endpoint activity.
• Understanding of Defender onboarding, sensor health and policy status.
• Familiarity with Windows OS, PowerShell and endpoint administration.
• Experience in 24x7 production or security operations.
• Experience with ITSM tools and incident management processes.

Mansioni

• Provide L2 support for Defender alerts, incidents and service requests.
• Investigate endpoint detections, malware detections and suspicious activities.
• Analyze investigation data to determine incident scope and containment.
• Troubleshoot Defender sensor health, onboarding and reporting issues.
• Coordinate with SOC and L3 teams for complex incidents and remediation.
• Maintain incident timelines and remediation records.
• Support security policy compliance and reporting across Defender platform.

Conoscenze

Microsoft Defender for Endpoint

Endpoint protection

Threat analysis

Incident handling

PowerShell

Windows administration

Security monitoring

Incident escalation

Cross-team coordination

ITSM tools

Strumenti

ServiceNow

PowerShell

Descrizione del lavoro

Gruve in San Francisco seeks an experienced L2 System Administrator to support Microsoft Defender security operations across enterprise endpoints and infrastructure. You will investigate alerts, analyze endpoint threats and troubleshoot Defender issues to ensure rapid containment and remediation.

You will coordinate with SOC, L3 and Endpoint teams to drive incident response, policy compliance and stable Defender health.