Senior EDR Analyst (Endpoint Security)

OVERVIEW AND REPORTING RELATIONSHIP

We are seeking a highly skilled Sr. EDR Analyst (Endpoint Security) to join our Cybersecurity team. This role is responsible for implementing, managing, monitoring, and optimizing Endpoint Detection and Response (EDR) solutions to protect enterprise endpoints against cyber threats. The ideal candidate will have hands-on experience with EDR platforms, Identity Threat Detection and Response (ITDR), threat monitoring, incident investigation, and endpoint security technologies.

RESPONSIBILITIES

Endpoint Security Administration

• Implement and manage Endpoint Detection and Response (EDR) solutions to monitor, detect, investigate, and secure endpoints against cybersecurity threats.
• Support and administer Identity Threat Detection and Response (ITDR) and endpoint encryption technologies to strengthen endpoint and identity security posture.
• Provide operational support for endpoint security solutions.
• Support change management tasking relative to the security policies associated with endpoint security solutions.
• Evaluate security exception requests to determine legitimacy and completeness of requests prior to escalation to management.
• Review endpoint security alerts to determine true or false positives based on industry standards.
• Review Threat Reports generated from Endpoint security tools and provide recommendations and plans for appropriate resolutions.
• Continually assess, report on, and make recommendations regarding proposed architectures, strategies, and systems in the endpoint security space.
• Ensure endpoint security platforms, policies, and emerging technologies meet organizational standards and security best practices.
• Support audit and compliance activities by providing acceptable evidence of endpoint security controls and supporting information.
• Troubleshoot and resolve issues related to endpoint security technologies in collaboration with colleagues from IT departments and functional stakeholders.
• Serve as an escalation point for endpoint security technologies.
• Ensure OS level configuration and patch management standards are deployed and adhered to.
• Configuration and support of endpoint technology policies for all applicable endpoint security technologies, including but not limited to Anti-malware, DLP, EDR, endpoint encryption, and Identity Threat Detection and Response (ITDR) solutions.
• Support of complex technical projects, meeting target timelines, providing technical support to project meetings, authoring project documentation when required, and help to resolve issues.
• Tune and maintain security policies and enhancements to protect company sensitive and confidential information to mitigate security threats to endpoints, assets, data, and users.
• Review technical security exception requests submitted by various personnel across the organization. Conduct technical risk assessment of each request to make recommendations and improve security risk across the enterprise.

QUALIFICATIONS

• Hands-on experience with Endpoint Detection and Response (EDR) platforms such as Microsoft Defender for Endpoint, CrowdStrike Falcon, SentinelOne, or Cortex XDR preferred.
• Experience with Identity Threat Detection and Response (ITDR) technologies such as Microsoft Defender for Identity, CrowdStrike Falcon Identity Protection, CyberArk Identity Security Platform, SentinelOne Singularity Identity, Okta Identity Threat Protection, or similar solutions preferred.
• Information Systems (IS) security professional with a broad range of knowledge in vulnerability and endpoint security systems/processes.
• Intermediate or advanced understanding of malware families, their types, and threats they pose.
• Strong technical background of endpoint security tools, as well as network security best practices.
• Demonstrated ability in identification of vulnerabilities/threats to data, systems and networks.
• In-depth understanding of operating systems internal, the mechanics of OS exploits, methods of preventing and/or detecting OS exploits and endpoint hardening.
• Comprehensive knowledge of cloud infrastructure, virtual platforms, encryption technologies, endpoint protection, network and cybersecurity tools.
• Demonstrated knowledge of security controls for network, applications, and operating systems.
• Knowledge of existing endpoint security technologies and capabilities to partner with internal IT teams to build and operationalize endpoint security solutions.
• Fundamental understanding of bi-directional traffic flow sources from the endpoints.
• Ability to navigate and work effectively across a complex, geographically dispersed organization.
• Fluency in speaking and communicating in English.

EDUCATION AND WORK EXPERIENCE

• Minimum three of experience
• BS in Computer Science or equivalent field.
• Preferred education and/or experience: Relevant industry recognized certifications (CISSP, CompTIA Security+,
• CEH, GIAC, Security+, etc.)

SPECIALIZED KNOWLEDGE, SKILLS & ABILITIES:

• Experience supporting or administering endpoint encryption technologies such as Microsoft BitLocker, Microsoft Intune, McAfee Drive Encryption (Trellix), VMware Workspace ONE UEM, or similar solutions is preferred.
• Effectively communicate security goals effectively with other departments.
• Ability to work within an environment of frequently changing priorities.
• Knowledge of industry trending threats, security tools, and best practices.
• Proven ability in the performance of information security risk assessments.
• Experience in performing risk and compliance assessments of new and existing solutions.
• Ability to provide guidance and recommended remediation or alternative solutions for both internal and external supported environments.
• Ability to provide guidance in the identification, documentation and rating of threats/vulnerabilities, and remediation steps recommended to reduce risks to data, systems and networks.