Senior Security Engineer – EDR & Malware Defence

Job Description

Role/Job Title

Senior Infra Security Engineer

(Endpoint & Malware Defence)

Experience: 10+ years Employment Type: Full-time

Job Purpose:

IDFC FIRST Bank is seeking a Senior Security Engineer to own and enhance its Endpoint Detection & Response (EDR/XDR) capability. This role focuses on endpoint threat detection, behavioural analysis, threat hunting, and incident response, ensuring rapid identification, containment, and remediation of endpoint-based attacks across the enterprise.

Key Responsibilities:

EDR & Endpoint Security Engineering:

· Own the design, deployment, tuning, and lifecycle management of EDR/XDR platforms (SentinelOne, CrowdStrike, Microsoft Defender for Endpoint).

· Optimize detection policies, exclusions, response actions, and telemetry collection to balance security efficacy and operational stability.

· Ensure endpoint protection coverage across Windows, Linux, and VDI environments.

Threat Detection, Hunting & Response:

· Investigate and triage EDR alerts using behavioural analytics and threat intelligence.

· Perform hypothesis-driven threat hunting leveraging MITRE ATT&CK techniques and endpoint telemetry.

· Identify malicious activity including malware, living-off-the-land attacks, credential abuse, and persistence mechanisms.

· Lead containment, eradication, and recovery actions in coordination with SOC and Incident Response teams.

Detection Engineering & Automation:

· Develop, tune, and validate detection logic, alert use-cases, and response workflows.

· Integrate EDR telemetry with SIEM and SOAR platforms to enable automated enrichment and response.

· Continuously improve detection fidelity and reduce false positives through data-driven analysis.

Malware & Forensics Support

· Conduct root cause analysis for endpoint-based incidents.

· Support malware analysis efforts through behavioural investigation and forensic artifact analysis (without mandatory reverse engineering).

· Contribute to post-incident reviews and control improvements.

Governance & Continuous Improvement

· Maintain playbooks, SOPs, and investigation documentation.

· Track emerging endpoint threats, attack techniques, and EDR advancements.

· Provide recommendations to improve endpoint security posture, policies, and controls.

Mandatory Skills

· Hands-on experience with EDR/XDR platforms (SentinelOne, CrowdStrike, Microsoft Defender for Endpoint).

· Strong understanding of endpoint attack techniques, malware behaviour, and adversary TTPs.

· Experience with MITRE ATT&CK, threat intelligence, and behavioural analytics.

· Working knowledge of SIEM integration and alert triage workflows.

· OS-level understanding of Windows and Linux endpoints.

· Exposure to endpoint-related security controls (DLP, device control, application control).

Good to Have

· Threat hunting experience using endpoint telemetry.

· Scripting or automation skills (PowerShell, Python).

· SOAR exposure.

· Vendor certifications (SentinelOne, Microsoft Security, CrowdStrike).

Experience & Education

Minimum 5 years of experience in endpoint security, EDR, SOC, or detection engineering roles.

Bachelor’s degree in Engineering / Computer Science (Master’s preferred).