Job Description L2 Endpoint Security Engineer

Job Title: L2 EndpointSecurity Engineer

Location: Hyderabad

Experience: Minimum 57 years

Qualification:

B.E/B.Tech/MCA with minimum 5 years of relevant experience

OR BCA/BSc-IT with minimum 7 years of relevant experience

Certifications Required:

Must possess CEH, CHFI, GSEC, GMON, ITIL (at least one mandatory)

OEM certification in at least one endpoint or cloud security platform (Symantec, Palo Alto Cortex XDR, Netskope) preferred

Job Summary:

We are looking for a skilled and experienced L2 Endpoint Security SOC Engineer to join our Security Operations Center. This role involves continuous monitoring, administration, and response activities related to endpoint protection and threat detection platforms including Symantec Endpoint Protection, Palo Alto Cortex XDR, and Netskope. The engineer will be responsible for investigating endpoint-related alerts, ensuring endpoint policy compliance, and supporting the overall endpoint and data security posture of the organization.

Key Responsibilities:

Monitor and manage Symantec, Cortex XDR, and Netskope consoles for alerts, incidents, and compliance status.
Investigate and respond to endpoint threats such as malware, ransomware, suspicious behaviors, and data exfiltration attempts.
Perform policy reviews, tuning, and exception handling for endpoint security solutions.
Troubleshoot issues related to agent deployment, health, and communication with management servers.
Work on alerts escalated from L1 SOC team and ensure timely resolution or escalation to L3.
Review endpoint-related threat intelligence feeds and correlate with internal alerts for proactive defense.
Support forensic investigation activities on compromised endpoints and assist in evidence gathering.
Track and ensure timely remediation of endpoint vulnerabilities in coordination with IT teams.
Participate in incident response, root cause analysis, and recovery actions related to endpoint attacks.
Maintain endpoint compliance across servers, desktops, laptops, and mobile devices as per organizational security policies.
Document standard operating procedures (SOPs), investigation steps, and known issues/resolutions.
Collaborate with network and cloud security teams to investigate multi-vector threats.
Generate regular reports and dashboards on endpoint status, threat trends, and agent health metrics.
Assist in configuration backup/restore and version upgrades of endpoint security solutions.
Participate in internal audits and support external compliance requirements (ISO, PCI, etc.).
Provide feedback on tuning and feature enhancements to improve endpoint protection efficiency.

Work closely with SOC teams to correlate Endpoint events with other security incidents.

Perform VA/PT remediation from Endpoint configuration perspective.

Demonstrate proficiency in Microsoft Excel and PowerPoint to support reporting and presentations.

Maintain awareness of latest security threats and Endpoint tools feature enhancements from OEMs.

Desired Skillset:

Hands-on experience with Symantec Endpoint Protection, Palo Alto Cortex XDR, and/or Netskope.
Experience in endpoint incident handling and threat response.
Good understanding of antivirus, EDR/XDR, DLP, and CASB functionality.
Strong troubleshooting and analytical skills related to endpoint protection.
Knowledge of Windows and Linux systems from a security perspective.
Good understanding of security operations, ticketing workflow, and SLA adherence.
Excellent communication and documentation skills.
Ability to work in 24x7 support environment, including night shifts and weekends.

Lead - Captive Operations