Job Purpose: -
To operate and safeguard the organization's endpoint estate by monitoring Trend Micro AV/XDR detections, triaging malware and suspicious activity, and executing containment actions under SOC/IR guidance. The role keeps endpoints across Windows, macOS, and Linux patched, compliant, and aligned with baseline security controls, while maintaining accurate incident documentation in the ITSM system and escalating complex or high-risk cases to L2/L3 specialists.
Primary Responsibilities:
- Monitor Trend Micro AV/XDR alerts for malware, suspicious behavior, unauthorized applications, and potential network intrusion attempts.
- Validate detections, assess severity levels, and escalate complex or high-risk cases to L2 specialists when required.
- Identify recurring threats, behavioral anomalies, and unusual endpoint patterns that require deeper investigation or correlation.
- Assist in scheduling, deploying, and validating OS patches and security updates across Windows, macOS, and Linux endpoints.
- Support monthly patch cycles and report systems that require follow-up remediation or manual intervention.
- Deploy updates for common applications such as browsers, productivity suites, and runtime components.
- Validate patch installation success, identify patch failures, and escalate unresolved issues for further action.
- Execute containment actions under SOC/IR guidance, including network isolation, process termination, account disablement, forced sign-outs, and session or token revocation.
- Monitor endpoint agent connectivity, signature version status, and enforcement of applied security policies.
- Track endpoint compliance posture, highlight deviations requiring remediation, and ensure consistent enforcement of baseline security controls.
- Log incidents, update ITSM tickets accurately, and follow established SOPs for documentation and workflow adherence.
- Maintain detailed documentation of actions taken, observations made, and incident timelines to support audit readiness.
- Report repeated infections, suspicious endpoint behavior, or unresolved anomalies to L2 teams for further analysis.
Minimum Work Experience & Education: -
- Minimum 5 years of experience in a similar endpoint engineering or endpoint security operations role.
- Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related discipline.
