Senior Security Engineer EDR & Malware Defence

EDR & Endpoint Security Engineering: Own the design, deployment, tuning, and lifecycle management of EDR/XDR platforms (SentinelOne, CrowdStrike, Microsoft Defender for Endpoint). Optimize detection policies, exclusions, response actions, and telemetry collection to balance security efficacy and operational stability. Ensure endpoint protection coverage across Windows, Linux, and VDI environments. Threat Detection, Hunting & Response: Investigate and triage EDR alerts using behavioural analytics and threat intelligence. Perform hypothesis-driven threat hunting leveraging MITRE ATT&CK techniques and endpoint telemetry. Identify malicious activity including malware, living-off-the-land attacks, credential abuse, and persistence mechanisms. Lead containment, eradication, and recovery actions in coordination with SOC and Incident Response teams. Detection Engineering & Automation: Develop, tune, and validate detection logic, alert use-cases, and response workflows. Integrate EDR telemetry with SIEM and SOAR platforms to enable automated enrichment and response. Continuously improve detection fidelity and reduce false positives through data-driven analysis. Malware & Forensics Support Conduct root cause analysis for endpoint-based incidents. Support malware analysis efforts through behavioural investigation and forensic artifact analysis (without mandatory reverse engineering). Contribute to post-incident reviews and control improvements. Governance & Continuous Improvement Maintain playbooks, SOPs, and investigation documentation. Track emerging endpoint threats, attack techniques, and EDR advancements. Provide recommendations to improve endpoint security posture, policies, and controls. Mandatory Skills Hands-on experience with EDR/XDR platforms (SentinelOne, CrowdStrike, Microsoft Defender for Endpoint). Strong understanding of endpoint attack techniques, malware behaviour, and adversary TTPs. Experience with MITRE ATT&CK, threat intelligence, and behavioural analytics. Working knowledge of SIEM integration and alert triage workflows. OS-level understanding of Windows and Linux endpoints. Exposure to endpoint-related security controls (DLP, device control, application control). Good to Have Threat hunting experience using endpoint telemetry. Scripting or automation skills (PowerShell, Python). SOAR exposure. Vendor certifications (SentinelOne, Microsoft Security, CrowdStrike). Experience & Education Minimum 5 years of experience in endpoint security, EDR, SOC, or detection engineering roles. Bachelors degree in Engineering / Computer Science (Masters preferred). .