Senior Security Engineer – EDR & NDR

We're looking for a Senior Security Engineer specializing in Endpoint Detection & Response (EDR) and Network Detection & Response (NDR) to design, implement, optimize, and support enterprise security platforms across customer environments. This role is ideal for a hands-on security engineer with strong experience in endpoint and network detection technologies, platform integrations, threat hunting, and security operations. Key Responsibilities • Deploy, configure, administer, and optimize enterprise EDR platforms. • Manage NDR platforms, including sensor configuration, network visibility, behavioral analytics, and detection tuning. • Integrate EDR/NDR solutions with SIEM, SOAR, identity, and threat intelligence platforms. • Troubleshoot platform issues, perform upgrades, health checks, and lifecycle management. • Support incident response activities, endpoint containment, malware remediation, and forensic investigations. • Conduct threat hunting and improve detection use cases aligned with the MITRE ATT&CK framework. • Develop automation workflows using APIs and scripting. • Maintain technical documentation, SOPs, architecture diagrams, and operational runbooks. • Collaborate with SOC, Incident Response, Threat Intelligence, and Security Engineering teams. Requirements • 5–7 years of experience in cybersecurity engineering or security operations. • At least 4 years of hands-on experience administering enterprise EDR platforms. • At least 3 years of experience administering NDR platforms. Experience with one or more EDR solutions: • Microsoft Defender for Endpoint • CrowdStrike Falcon • VMware Carbon Black • Trend Micro Vision One / Apex One Experience with NDR solutions such as: • Vectra AI • ExtraHop Reveal(x) • Working knowledge of SIEM platforms, preferably Splunk Enterprise Security and/or Microsoft Sentinel. • Familiarity with threat hunting, incident response, detection engineering, and MITRE ATT&CK. • Understanding of Windows/Linux security, Active Directory, Microsoft Entra ID, TCP/IP, DNS, VPNs, and firewalls. • Scripting experience with PowerShell and/or Python, and familiarity with REST APIs. • Experience in a SOC or Managed Security Services (MSS) environment is highly desirable. Preferred Certifications • CrowdStrike Falcon Administrator / Responder • Microsoft SC-200 or AZ-500 • VMware Carbon Black or Trend Micro Vision One certifications • Vectra AI or ExtraHop certifications • Splunk or Microsoft Sentinel certifications • CISSP, GCIH, GCED, CySA+, Security+, or equivalent