:-

1. Integrate EDR capabilities into the broader security operations of the organization. Collaborate with SOC analysts to ensure seamless coordination and communication between EDR alerts and SOC workflows. Contribute to the development of playbooks, runbooks, and standard operating procedures (SOPs) that enable SOC analysts to effectively triage, investigate, and respond to EDR alerts.

2. Analyze emerging cyber threats and trends. Contribute to EDR policy creation by providing insights into the latest attack techniques, malware variants, and threat actor tactics, techniques, and procedures (TTPs). This information informs the development of detection criteria and response procedures within the EDR policy.

3. Leverage technical expertise to develop detection rules and signatures for the EDR solution. Design rules based on known Indicators of Compromise (IOCs), behavioral anomalies, and attack patterns to enhance the EDR solutions ability to identify malicious activity on endpoints. Ensure that detection rules are accurate, effective, and tuned to minimize false positives.

4. Conduct in-depth investigations to determine the scope, impact, and root cause of incidents. Contribute to EDR policy creation by defining procedures for incident investigation, including data collection, analysis, and correlation across multiple endpoints. Identify gaps in detection capabilities and recommend enhancements to the EDR policy based on lessons learned from incident investigations.

5. Continuously monitor the performance of the EDR solution and assess its effectiveness in detecting and responding to threats. Collaborate with other security team members to optimize EDR policies,



fine-tune detection rules, and adjust response procedures based on real-world observations and feedback.

6. Provide mentorship and guidance to junior analysts and IT staff involved in EDR operations. Conduct training sessions, workshops, and knowledge sharing sessions to enhance the skills and expertise of the security team members. Empower others to understand and adhere to the EDR policy, fostering a culture of security awareness and collaboration within the organization.

7. Regularly review and update the EDR policy to incorporate lessons learned from incidents and changes in the threat landscape. This ensures the policy remains current and effective in addressing emerging cybersecurity challenges.

Roles&Responsibilities; :-

1. Install, configure, and maintain EDR software across the organization’s endpoints. Create the necessary packages for EDR client installation.

2. Developing and implementing security policies and procedures related to Endpoint security. Enable the different policy like Anti Malware, Behavioral, Device control on EDR as per the best security practice.

3. Proactive searching for signs of Compromise or emerging threats

4. Ensuring endpoints are up to date with security patches and update the platform and agents to minimize vulnerabilities.

5.



Level 3 Troubleshoot for failed installation not resolved by the L2 engineer.

6. Provide regular updates and reports on security incidents, compliance report, deployment status, issues encountered.

7. Configuring the necessary policies and exceptions on EDR console including group assignment rules based on the host name, IPs, domain name, etc. Finetune the policy based on alerts triggered for the deployed endpoints and performance issues observed during installation.

8. Integration of EDR with SIEM, ITSM and other tools

Additional EDR implementation Roles &

Responsibilities from the one given above.

1. Assessing the organization existing endpoint, understanding the requirements, and planning the deployment of EDR solutions

2. Perform the POC of the different policies and installation on different OS.

3. Create design document, policy document, prerequisite installation document guide.

Roles and Responsibilities for EDR consultant

1. Assessing the organization existing endpoint, understanding the requirements, and planning the deployment of EDR solutions

2. Providing Guidance on vendor selection, negotiation, and management of EDR solutions

3. Provide expert recommendations on the selection, implementation of the EDR solutions.

4. Offer technical expertise and guidance on EDR capabilities, features as per best security practice.

5. Developing and implementing security policies and procedures related to Endpoint security. Enable the different policy like Anti Malware, Behavioral, Device control on EDR as per the best security practice.

📌 CrowdStrike EDR (Bengaluru)
🏢 Wipro
📍 Bengaluru