Key Roles &

Responsibilities :

- Continuous Alert Monitoring &
- Triage : Monitor high-volume alerts from WAF (application layer attacks), EDR (endpoint/host anomalies), and SSE (data loss, malicious web traffic, unauthorized cloud application usage) via our SIEM/SOAR platform.
- Deep-Dive Investigation : Analyze security events to determine root cause. Validate if anomalous endpoint behavior, suspicious web requests, or strange cloud data access represents a true positive threat or a benign business action.
- WAF Tuning &
- Management : Review WAF blocks and alerts (e.g., SQLi, XSS, automated bot traffic). Coordinate with application teams to tune false positives and optimize WAF rule sets without disrupting legitimate traffic.
- Endpoint Incident Containment : Leverage EDR tools to isolate compromised endpoints, kill malicious processes, harvest forensic artifacts, and investigate execution chains (e.g., malicious PowerShell, process injection).
- SSE &
- Data Security Enforcement : Track anomalies in data movement and web gateways. Identify shadow IT, potential data exfiltration vectors, and violations of our Zero Trust Network Access (ZTNA) policies.
- Reporting &
- Documentation : Document comprehensive investigation timelines and findings in our ticketing system. Create weekly/monthly metrics reporting on alert volumes, true vs. false-positive ratios, threat trends, and time-to-remediate.
- Playbook Optimization :



Work closely with senior security engineers to automate repetitive triage tasks by developing and refining SOAR (Security Orchestration, Automation, and Response) playbooks.

Education &

- Certificates :
- Bachelor's degree - BTech or equivalent.

Technical Skills :

- Experience : 2 - 4 years of dedicated SOC, MDR, or specialized security monitoring experience focusing on endpoint and web application defenses.
- EDR Tool Proficiency : Deep, practical experience using major EDR/XDR platforms (e.g., CrowdStrike Falcon, SentinelOne, Microsoft Defender for Endpoint, Carbon Black).
- WAF Experience : Solid understanding of HTTP/HTTPS protocols, the OWASP Top 10, and experience triaging alerts or adjusting rules in enterprise WAFs (e.g., Cloudflare, Akamai, AWS WAF, Imperva).
- SSE/SASE Literacy : Familiarity with Security Service Edge architectures, including Secure Web Gateways (SWG), Cloud Access Security Brokers (CASB), and Zero Trust Network Access (ZTNA) solutions (e.g., Zscaler, Netskope, Palo Alto Prisma).
- Log &
- Packet Analysis : Solid capability in reading and interpreting security event logs, syslogs, application logs, and analyzing network traffic patterns.
- Analytical Mindset : Excellent investigative skills with the ability to correlate seemingly unrelated alerts (e.g., a WAF alert followed by a specific EDR process launch) to map out an adversary's footprint.

📌 Endpoint Security Specialist (India)
🏢 Peoplemint Consultants
📍 India