Endpoint Security Operations Engineer (L2) – Microsoft Defender

Position summary:

We are looking for a skilled L2 System Administrator to support Microsoft Defender security operations across enterprise endpoints and infrastructure. The role is responsible for investigating security alerts, analyzing endpoint threats, troubleshooting defender agent and policy issues, supporting incident containment and remediation, and maintaining security compliance. The administrator will work closely with L1 operations, L3 Security SMEs, SOC, Endpoint, Identity and Infrastructure teams to ensure effective threat response and SLA compliance.

Key Responsibilities:

Microsoft Defender Operations

• Provide L2 support for Microsoft Defender alerts, incidents and service requests.
• Investigate endpoint detection alerts, malware detections, suspicious activities and security incidents using Microsoft Defender for Endpoint.
• Analyze device timelines, alert evidence, process activity and investigation data to determine incident scope.
• Troubleshoot Defender sensor health, onboarding, connectivity, policy application and reporting issues.
• Support approved threat containment and remediation activities, including device isolation and threat remediation.
• Investigate antivirus detection, scan failures, signature updates and endpoint protection configuration issues.
• Monitor endpoint protection status and coordinate remediation of Defender health and compliance gaps.

 Security Incident Response & Remediation

• Investigate escalated security alerts and determine appropriate response actions within approved procedures.
• Support threat hunting, incident investigation and evidence collection as required.
• Coordinate with SOC and L3 Security teams for complex or high-severity incidents.
• Execute authorized remediation actions and validate endpoint security restoration.
• Support vulnerability and exposure remediation activities using Microsoft security tools where applicable.
• Maintain incident timelines, investigation evidence and remediation records.

 Microsoft Security Platform & Compliance

• Support Microsoft Defender portal operations, security policies and endpoint protection configurations within authorized scope.
• Monitor security dashboards, device risk status, protection coverage and sensor health.
• Support onboarding and offboarding of endpoints into Defender in coordination with Endpoint teams.
• Investigate security policy deviations and coordinate corrective actions with the relevant teams.
• Support security reporting, audit evidence collection and compliance activities.

 Operations & Service Management

• Resolve security operations incidents within defined SLAs and escalation procedures.
• Follow Incident, Problem, Change and Security Incident Management processes.
• Participate in major incident response, service restoration and post-incident reviews.
• Maintain runbooks, investigation procedures, operational documentation and shift handover notes.
• Coordinate with L1/L3, SOC, Endpoint, Identity, Network and In