Endpoint Security Operations Engineer (L2) – Microsoft Defender

Location: India
Department: Security & IT

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for an Endpoint Security Operations Engineer (L2) – Microsoft Defender based in India.

We are seeking an experienced Endpoint Security Operations Engineer to support enterprise-wide endpoint protection and Microsoft Defender security operations. In this hands-on L2 role, you will investigate security alerts, analyze endpoint threats, and troubleshoot Defender agents, sensors, and security policies. You will contribute to incident containment, threat remediation, and ongoing endpoint security compliance. Working closely with L1 operations, L3 security specialists, SOC, and infrastructure teams, you will help ensure effective threat response and service continuity. The position operates in a global 24/7 environment, requiring strong analytical skills, clear documentation, and effective coordination across international teams.

Accountabilities

• Provide L2 operational support for Microsoft Defender alerts, incidents, and service requests.

• Investigate endpoint detection alerts, malware detections, suspicious activity, and security incidents using Microsoft Defender for Endpoint.

• Analyze device timelines, alert evidence, process activity, and investigation data to assess the scope and potential impact of threats.

• Troubleshoot Defender sensor health, endpoint onboarding, connectivity, policy application, reporting, antivirus scans, and signature updates.

• Support approved threat containment and remediation actions, including device isolation and validation of endpoint security restoration.

• Assist with threat hunting, evidence collection, vulnerability remediation, and escalated security investigations in coordination with SOC and L3 teams.

• Monitor endpoint protection coverage, device risk status, security dashboards, and compliance gaps; coordinate corrective actions with relevant teams.

• Support endpoint onboarding and offboarding in Defender, security policy administration, audit evidence collection, and compliance reporting.

• Manage incidents within defined SLAs and follow established incident, problem, change, and security incident management procedures.

• Participate in major incident response, service restoration, and post-incident reviews.

• Maintain investigation records, incident timelines, runbooks, operational documentation, and shift handover notes.

• Coordinate with L1/L3 operations, SOC, Endpoint, Identity, Network, and Infrastructure teams, escalating complex threats and platform issues appropriately.

• Ensure effective follow-the-sun operational handovers across APAC, EMEA, and North America.

Requirements:

• 3–6 years of experience in enterprise security operations, Microsoft Defender administration, endpoint protection, or security incident support.

• Hands-on experience with Microsoft Defender for Endpoint and its alert investigation and security response capabilities.

• Strong understanding of endpoint protection, malware detection, threat analysis, and security incident handling.

• Experience investigating security alerts, device timelines, suspicious processes, and endpoint activity.

• Knowledge of Defender onboarding, sensor health, security policies, endpoint protection configurations, and device compliance.

• Good understanding of Windows operating systems, endpoint administration, and basic PowerShell.

• Familiarity with incident severity assessment, containment, remediation, and escalation procedures.

• Experience using the Microsoft Defender portal and security monitoring dashboards.

• Familiarity with ServiceNow or equivalent IT service management tools and incident management workflows.

• Experience working in enterprise production environments or 24/7 security operations.

• Strong analytical, troubleshooting, documentation, communication, and cross-functional coordination skills.

• Preferred: Microsoft SC-200 or an equivalent security operations certification.

• Preferred: Exposure to Microsoft Defender XDR, Microsoft Sentinel, KQL, threat hunting, and endpoint investigation techniques.

• Preferred: Familiarity with Microsoft Defender for Identity, Defender for Office 365, vulnerability management, and security compliance.

• Preferred: Experience with PowerShell scripting and security operations automation.

Benefits:

• Remote working arrangement within India.

• Opportunity to work with Microsoft security technologies and enterprise endpoint protection environments.

• Exposure to global security operations and collaboration across international teams.

• Professional development through hands-on experience in threat investigation, incident response, and endpoint security.

• Collaborative environment focused on innovation, continuous learning, and inclusive teamwork.

• Salary, healthcare coverage, insurance, paid leave, and additional benefits are not specified in the job description.

How Jobgether works:

We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team.

We appreciate your interest and wish you the best!

 Why Apply Through Jobgether? 

Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.

#LI-CL1