Senior SOC Engineer (EDR)

Overview:

The SOC Senior Engineer (EDR) is a specialized highly skilled and experienced Senior SOC Engineer with deep expertise in Endpoint Detection and Response (EDR) technologies. This role will be responsible for managing, optimizing, and enhancing our EDR capabilities to ensure rapid detection, investigation, and response to endpoint threats across the organization.

Responsibilities:

EDR Platform Management:

• Administer and maintain enterprise EDR solutions (e.g., CrowdStrike, Sentinel One, Microsoft Defender for Endpoint).
• Ensure optimal configuration, performance, and coverage across all endpoints.
• Define endpoint telemetry strategies, agent deployment models, and data retention policies.
• Ensure scalability, performance, and resilience of EDR infrastructure across hybrid environments.

Platform Deployment & Integration:

• Lead deployment and configuration of EDR agents across diverse operating systems and environments.
• Integrate EDR with SIEM, SOAR, and threat intelligence platforms to enable automated detection and response.

Detection Engineering:

• Develop and fine-tune custom detection rules, behavioral analytics, and response playbooks.
• Collaborate with threat hunters and incident responders to enhance detection logic and reduce false positives.

Operational Optimization:

• Monitor EDR platform health, performance, and coverage.
• Conduct regular audits, tuning, and upgrades to maintain optimal functionality.

Incident Response Enablement:

• Provide engineering support during endpoint-related security incidents.
• Working with the SOC Analysts to facilitate and effective Monitoring and analysis of EDR alerts to identify malicious activity.
• Align with Incident Responders to facilitate investigations into endpoint-related incidents and coordinate response efforts.

Documentation & Compliance:

• Maintain detailed documentation of EDR architecture, configurations, and operational procedures.
• Ensure alignment with regulatory frameworks and internal security policies.

Use Case & Rule Development:

• Develop and fine-tune detection rules, behavioral analytics, and response playbooks.
• Collaborate with threat intelligence, Incident Response, and SOC Monitoring teams to enhance detection capabilities.

Automation & Integration:

• Integrate EDR with SIEM and SOAR platforms to streamline workflows.
• Automate response actions and containment procedures where applicable.

Reporting & Documentation:

• Generate reports on EDR activity, threat trends, and system health.
• Maintain detailed documentation of configurations, procedures, and incident handling.

Collaboration & Mentorship:

• Work closely with SOC analysts, IT, and security teams to improve endpoint security posture.

Qualifications: