Job Role The Assistant Manager
- IT Security Operations will be responsible for the day-to-day management, implementation, monitoring, and optimization of the organization's endpoint and IT security controls. The role will have a strong technical focus on EDR/XDR, endpoint protection, vulnerability and patch management, security hardening, incident response, security tools, and implementation of cybersecurity controls across the IT environment. Experience

Experience:
4–8 years in IT Security / Cybersecurity / Security Operations, with solid hands-on experience in endpoint and security technologies. 1. EDR / XDR Operations & Management Own the day-to-day administration, monitoring, and operational management of EDR/XDR platforms across enterprise endpoints and servers. Monitor endpoint security posture and ensure adequate EDR/XDR coverage across Windows, macOS, Linux, and other supported platforms. Perform detailed analysis of endpoint telemetry including processes, command lines, network connections, file activities, registry changes, persistence mechanisms, and user activity. Tune EDR/XDR policies and detection rules to minimize false positives while maintaining appropriate security coverage. Track EDR/XDR agent health, outdated agents, inactive devices, policy mismatches, and deployment failures. Evaluate and implement advanced EDR/XDR capabilities such as behavioral protection, application control, exploit prevention, ransomware protection, attack surface reduction, and threat hunting. Implement and maintain endpoint security controls across corporate devices and servers. Manage Antivirus/NGAV, EDR/XDR, host firewall, device control, application control, encryption, and endpoint protection policies. Support secure device provisioning, endpoint onboarding, security configuration, and decommissioning. 3. Vulnerability & Patch Management Own and coordinate the organization's vulnerability and patch management lifecycle. Analyze vulnerabilities based on severity, exploitability, business impact, asset criticality, and exposure. Coordinate with IT Infrastructure, Desktop Engineering, Server, Application, and Cloud teams for timely remediation. Manage patch deployment activities, patch compliance,



exceptions, and remediation validation. Investigate failed patches and coordinate corrective actions. Support emergency patching activities for actively exploited or zero-day vulnerabilities. Participate in and lead technical response to cybersecurity incidents involving endpoints, servers, applications, and infrastructure. Analyze EDR/XDR telemetry to identify attack vectors, affected assets, indicators of compromise, lateral movement, and persistence. Perform root-cause analysis and document incident timelines. Support threat hunting activities based on IOCs, TTPs, vulnerabilities, and emerging threats. 5. Security Tool Implementation & Administration Lead the technical implementation, configuration, and operationalization of cybersecurity products. Evaluate security products based on technical requirements, security capabilities, scalability, integration, and operational effectiveness. Integrate security tools with existing infrastructure, SIEM, IAM, ticketing systems, and other security platforms. Identify opportunities for automation and process improvement across security operations. Define and implement endpoint and server security hardening standards. Implement controls such as application control, attack surface reduction, endpoint firewall, device control, encryption, and privileged access restrictions. Review security configurations against industry best practices and organizational security requirements. 6. Security Hardening & Technical Controls Maintain product configurations, policies, integrations, certificates, agents, and operational documentation. Conduct Proof of Concept (PoC), testing, technical validation, and deployment planning for new security technologies. Manage security tools across endpoint, network, vulnerability management, DLP, encryption, application control,



and security monitoring domains. Coordinate with SOC/MDR teams and security vendors during major incidents. Develop and maintain technical incident response playbooks. Coordinate endpoint isolation, malicious file remediation, account containment, process termination, and other response actions as required. Perform initial triage, investigation, containment, eradication, and recovery activities. 4. Security Incident Response Establish patch compliance targets and continuously improve endpoint/server patching processes. Develop dashboards and management reports covering patch compliance, vulnerability aging, critical vulnerabilities, and remediation status. Track critical, high, and medium vulnerabilities through closure. Define patching priorities and remediation timelines based on organizational risk. Identify vulnerabilities across endpoints, servers, applications, and infrastructure using vulnerability management tools. Investigate endpoint-related security events and perform root-cause analysis. Identify gaps in endpoint security configurations and drive remediation with relevant IT teams. Define and enforce endpoint security baselines and hardening standards. 2. Endpoint Security Prepare operational dashboards and reports covering EDR coverage, detections, incidents, agent health, and remediation status. Coordinate with vendors for complex incidents, product issues, detection gaps, and technical escalations. Develop and maintain EDR/XDR detection and prevention policies based on emerging threats and organizational requirements. Investigate and respond to endpoint alerts, suspicious activities, malware detections, behavioral detections, and security incidents. Manage EDR/XDR deployment, agent health, policy configuration, exclusions, prevention controls, detection rules, and security profiles. Key Technical Responsibilities The individual will work closely with IT Infrastructure, Network, Cloud, Engineering, Application, IAM, GRC, and other stakeholders to identify security gaps, implement remediation measures, respond to security incidents, and continuously improve the organization's security posture.

📌 Information Technology Operations Manager (Gurugram)
🏢 Delhivery
📍 Gurugram