Hybrid Managed EDR Engineer I

at Proficio

• Job title: Managed EDR Engineer I
• Job type: Full Time
• Experience level: Mid level, Senior
• Salary: $80,000 per year
• Degree requirement: No Education Requirement
• Tech skills: Cyber Security, Splunk
• Location requirements: Hybrid, Irvine, United States

About the role

• Managed EDR Engineer I managing EDR solutions for Proficio. Collaborating with engineering and project teams to enhance security posture via proactive threat hunting.

Responsibilities

• Deploy, configure, and maintain EDR solutions: MUST - Manage and optimize EDR platforms. This position will focus on **Sophos** work, but other platforms could include **CrowdStrike Falcon, Microsoft Defender for Endpoint**. Ensure that endpoints are adequately secured, and all EDR solutions are functioning effectively within the environment.
• Endpoint Security Management: Administer endpoint security management tools such as antivirus, web filtering, data loss prevention, and spam filtering, focusing on integration and coordination with EDR platforms to ensure a comprehensive security posture.
• Proactive Threat Hunting: Leverage the full capabilities of EDR tools to proactively **hunt for threats** across the enterprise environment. Utilize **CrowdStrike Falcon**'s Threat Graph, **Defender for Endpoint**'s advanced hunting queries, and **SentinelOne**’s behavioral AI to detect undetected threats and abuse.
• Incident Investigation and Response: Conduct in-depth investigations using **EDR solutions** to analyze complex account compromises, malware infections, and vulnerabilities. Use advanced detection mechanisms in **TrendMicro Vision One** and **CrowdStrike** to understand adversarial behavior and recommend appropriate mitigation strategies.
• Remediation and Prevention: Identify and implement **detection/prevention strategies** through EDR platforms. Leverage **Microsoft Defender for Endpoint** to automate response playbooks and block potential threats, and utilize **Apex One** to enhance protection against emerging threats.
• Tactics, Techniques, and Procedures (TTPs): Apply knowledge of **adversary TTPs** across multiple attack surfaces using EDR tools. Utilize real-time intelligence from **CrowdStrike, **Defender for EndPoint and from other EDR tools to stay ahead of emerging tactics and enhance detection capabilities.
• Cross-functional Communication: Lead technical investigations and communicate actionable insights derived from **EDR tools** to cross-functional teams. Ensure that the analytic findings and mitigations are clear and actionable across different teams.
• Continuous Improvement: Continuously analyze data from EDR tools like CrowdStrike, Defender for Endppoint. **TrendMicro Vision One** to identify trends in adversary behavior. Under the direction and guidance of management, help to create new detection rules and adjust EDR settings to ensure optimal performance and coverage.
• Security Analytics and Data Interpretation: Use data from EDR tools and other EDR platforms to analyze, interpret, and quantify trends. This supports the investigation of threats and validates security incidents.

Requirements

• 2+ years of experience with IT in a professional work environment
• 18 months+ of experience assisting with deployment, configuration, or maintenance processes that support the Sophos Enterprise EDR Solutions. Other beneficial tools include Carbon Black EDR, CrowdStrike Falcon, Microsoft Defender APT, and/or Sentinel One
• Additional experience in TrendMicro ApexOne, Vision, and/or Cisco AMP are pluses
• 3+ years of experience in EDR and/or AV; previous work in malware and attack analysis (is Plus), research, investigation, and response highly desirable
• 1+ years of experience with performing systems administration, including basic troubleshooting and installation, monitoring system performance or availability and performing security upgrades
• Knowledge of network security architecture concepts including topology, protocols, components, and principles
• Knowledge of various Enterprise Operating System (OS) configurations and management tools for use during deployment, configuration, and management of EDR solutions
• **Additional Qualifications:**
• Good to have experience working in a Security Operations Center (SOC) environment including Incident Response, Vulnerability Scanning, Threat Hunting, Network Monitoring/Log Management, or Compliance Management
• Good to have experience with complimentary Enterprise Security Tools including Security Information & Event Management (SIEM), Threat Intelligence Platforms (TIPs), or Network Monitoring Tools
• Experience with triaging security events in a security operations center (SOC) environment, leveraging data collected from enterprise security solutions
• Knowledge of intrusion detection methodologies and techniques for detecting host and network-based intrusions
• Ability to integrate Cybersecurity data using enterprise or custom tools data aggregation and analysis tools, including Splunk and Elastic

Benefits

• Salary $80K
• Peer training and mentoring with upward mobility
• Health, Dental and Vision plans available first of the month and other benefits available from day 1
• Unlimited Flex Time Off
• 401K plan
• Gym reimbursement
• Employee Assistance Program
• Life and Voluntary Life Insurance programs
• A culture that is flat enough for you to have a “seat at the table”, but layered enough to provide you with mentoring and support
• A place to work where security is considered a “team sport” – we work together to identify and stop cyber attacks
• Proficio is an EOE Employer
• Proficio collects certain personal information upon your submission of an application for an open position. More information is available about your consumer rights and our privacy policy at www.proficio.com/privacypolicy