FREE ACCESS
5,000–10,000 jobs/day
See all jobs on Scoutfield
Search thousands of fresh jobs every day.
Discover
- Fresh listings
- Fast filters
- No subscription required
Create a free account and start exploring right away.
Core Competencies
Role fitCore Competencies
Use this summary to align your resume positioning with the role.
Demonstrates expertise in Microsoft Defender for Endpoint, including incident investigation, threat analysis, and endpoint protection management. Proficient in coordinating security operations, remediation activities, and compliance reporting within enterprise environments.
Highest-signal resume keywords
Microsoft Defender For EndpointIncident InvestigationThreat AnalysisEndpoint Protection ManagementPowerShell Scripting
ATS Keywords
Tailor your resumeApplicant Tracking System Keywords
Tip: use these terms in your resume and cover letter to boost ATS matches.
Hard Skills
Endpoint ProtectionMalware DetectionSecurity Incident HandlingSecurity Policy ManagementVulnerability ManagementSecurity ComplianceThreat HuntingKQLMicrosoft SentinelServiceNow
Soft Skills
Analytical SkillsDocumentation SkillsCross-Team Coordination
Tools & Technologies
Microsoft Defender PortalSecurity Monitoring DashboardsITSM Tools
Certifications & Qualifications
Microsoft SC-200
Industry Keywords
Enterprise Security OperationsIncident Management Processes24x7 Production Operations
Tech Stack
Tools & technologiesITSMServiceNow
About the role
Key responsibilities & impact- Provide L2 support for Microsoft Defender alerts, incidents and service requests
- Investigate endpoint detection alerts, malware detections, suspicious activities and security incidents using Microsoft Defender for Endpoint
- Analyze device timelines, alert evidence, process activity and investigation data to determine incident scope
- Troubleshoot Defender sensor health, onboarding, connectivity, policy application and reporting issues
- Support approved threat containment and remediation activities, including device isolation and threat remediation
- Investigate antivirus detection, scan failures, signature updates and endpoint protection configuration issues
- Monitor endpoint protection status and coordinate remediation of Defender health and compliance gaps
- Investigate escalated security alerts and determine appropriate response actions within approved procedures
- Support threat hunting, incident investigation and evidence collection as required
- Coordinate with SOC and L3 Security teams for complex or high-severity incidents
- Execute authorized remediation actions and validate endpoint security restoration
- Support vulnerability and exposure remediation activities using Microsoft security tools where applicable
- Maintain incident timelines, investigation evidence and remediation records
- Support Microsoft Defender portal operations, security policies and endpoint protection configurations within authorized scope
- Monitor security dashboards, device risk status, protection coverage and sensor health
- Support onboarding and offboarding of endpoints into Defender in coordination with Endpoint teams
- Investigate security policy deviations and coordinate corrective actions with relevant teams
- Support security reporting, audit evidence collection and compliance activities
- Resolve security operations incidents within defined SLAs and escalation procedures
- Follow Incident, Problem, Change and Security Incident Management processes
- Participate in major incident response, service restoration and post-incident reviews
- Maintain runbooks, investigation procedures, operational documentation and shift handover notes
- Coordinate with L1/L3, SOC, Endpoint, Identity, Network and Infrastructure teams
- Escalate complex threats, platform issues and incidents requiring advanced investigation to L3/SOC
- Ensure effective APAC–EMEA–NLAM follow-the-sun handovers
Requirements
What you’ll need- 3–6 years of experience in enterprise security operations, Microsoft Defender administration, endpoint protection or security incident support
- Hands-on experience with Microsoft Defender for Endpoint and its security investigation capabilities
- Knowledge of endpoint protection, malware detection, threat analysis and security incident handling
- Experience investigating security alerts, device timelines, suspicious processes and endpoint activity
- Understanding of Defender onboarding, sensor health, security policies and endpoint protection status
- Knowledge of Windows operating systems, endpoint administration and basic PowerShell
- Understanding of incident severity, containment, remediation and escalation procedures
- Familiarity with Microsoft Defender portal and security monitoring dashboards
- Experience with ServiceNow or equivalent ITSM tools and incident management processes
- Strong analytical, documentation and cross-team coordination skills
- Experience in enterprise 24x7 production or security operations
- Microsoft SC-200 or equivalent security operations certification (preferred)
- Exposure to Microsoft Defender XDR, Microsoft Sentinel and KQL (preferred)
- Knowledge of threat hunting, attack techniques and endpoint investigation (preferred)
- Familiarity with Microsoft Defender for Identity and Defender for Office 365 (preferred)
- Experience with vulnerability management, security compliance and incident reporting (preferred)
- PowerShell scripting and security operations automation experience (preferred)
Benefits
Comp & perks- Dynamic environment with strong customer and partner networks
- Culture of innovation, collaboration, and continuous learning
- Diverse and inclusive workplace
- Equal opportunity employer