Cisco AMP

Job Title : L2 Operations Lead – Malware Tools

Experience : 10+ Years

Location : Gurugram

Work Mode : Hybrid – 2 Days in Office

Employment Type : Full-Time

Engagement Duration : 6+ Months

Number of Positions : 1

Support Level : L2 Operations

Domain : Endpoint Security & Malware Protection

About the Role :

We are looking for an experienced L2 Operations Lead – Malware Tools to manage and support enterprise endpoint protection and malware security platforms, with a primary focus on CrowdStrike. The ideal candidate will have strong expertise in endpoint detection and response (EDR), malware investigation, incident management, and endpoint security operations.

The role involves monitoring security platforms in a 24×7×365 support environment, resolving Level 2 incidents, troubleshooting endpoint security agents, and escalating complex issues to L3 teams when required. The candidate will also collaborate with cross-functional security and infrastructure teams to maintain effective endpoint protection and minimize recurring incidents.

Mandatory Skills :

CrowdStrike Falcon, EDR, Endpoint Security, Malware Detection & Investigation, Alert Triage, Threat Containment, Microsoft Defender, ServiceNow, SIEM/SOAR (Splunk), Windows Server, Incident Management, 24×7 Operations Support, and Python/PowerShell Scripting.

Key Responsibilities :

• Manage end-to-end security incident handling, from L1/L1.5 escalation through investigation, resolution, and closure.
• Monitor and support endpoint protection and malware security platforms in a 24×7×365 operational environment.
• Administer and maintain CrowdStrike Falcon and other endpoint detection and response (EDR) solutions.
• Investigate malware alerts, perform alert triage, assess risks, and implement appropriate containment and remediation actions.
• Troubleshoot endpoint security agent issues, including installation, deployment, connectivity, health monitoring, and performance.
• Install, configure, update, and maintain antivirus and endpoint protection solutions across servers.
• Manage endpoint security consoles, agent updates, patching, platform upgrades, and configuration changes.
• Escalate complex incidents to L3 teams with detailed investigation findings, impact assessments, and recommended actions.
• Maintain accurate and up-to-date incident records in ServiceNow, including investigation details, resolution steps, and closure notes.
• Participate in Root Cause Analysis (RCA) reviews and implement corrective and preventive measures.
• Develop and maintain Standard Operating Procedures (SOPs), troubleshooting guides, and knowledge-base articles.
• Analyze incident trends and recurring alerts to improve detection effectiveness and reduce repeated incidents.
• Collaborate with DLP, Hosting, Network Security, Identity and Access Management (IDAM), and other infrastructure teams to resolve cross-functional issues.
• Ensure compliance with client security policies, operational procedures, and established service-level agreements (SLAs).
• Provide clear incident updates, communicate security risks promptly, and recommend appropriate mitigation measures.

Required Technical Skills :

• Endpoint Security & EDR : Strong hands-on experience with endpoint protection, antivirus, and EDR technologies.
• CrowdStrike Falcon : Experience in administration, monitoring, policy management, alert investigation, and agent troubleshooting.
• Microsoft Defender : Knowledge of endpoint protection and malware detection capabilities.
• Malware Investigation : Expertise in alert triage, threat analysis, risk assessment, containment, and remediation.
• ITSM : Experience with incident, problem, and change management processes.
• Security Monitoring : Familiarity with SIEM/SOAR platforms and security event analysis.
• Operating Systems : Strong knowledge of Windows operating systems and endpoint security administration.
• Scripting : Basic to intermediate scripting knowledge in Python or PowerShell for troubleshooting and operational automation.
• Monitoring Tools : Familiarity with Splunk, DataDog, and related monitoring or security operations tools.

Tools & Technologies :

• CrowdStrike Falcon
• Microsoft Defender
• ServiceNow
• Splunk SIEM
• SOAR Platforms
• DataDog
• Antivirus and Endpoint Detection & Response (EDR) Solutions
• Windows Server and Windows Operating Systems
• Python / PowerShell

Required Experience & Qualifications :

• 10+ years of overall experience in IT operations, endpoint security, or related security operations functions, with strong hands-on L2 endpoint security experience.
• Proven experience supporting endpoint protection and malware security tools in an enterprise environment.
• Hands-on experience with CrowdStrike Falcon or other enterprise EDR solutions.
• Experience troubleshooting endpoint security agents and resolving security incidents.
• Strong understanding of malware investigation, alert triage, threat containment, and escalation procedures.
• Experience working in a 24×7 operational support environment.
• Good understanding of ITSM processes, including incident, problem, and change management.
• Experience maintaining operational documentation, SOPs, RCA reports, and knowledge-base articles.
• Strong analytical, troubleshooting, and problem-solving skills.
• Excellent written and verbal English communication skills.
• Ability to coordinate effectively with L1, L3, and cross-functional infrastructure and security teams.

Preferred Certifications :

• CrowdStrike Falcon Administrator
• Microsoft Certified: Security Operations Analyst Associate (SC-200)
• CompTIA Security+

Key Performance Expectations :

• Timely resolution of L2 incidents within defined SLAs.
• Effective investigation and containment of malware and endpoint security threats.
• Reduced recurrence of incidents through RCA and preventive actions.
• Accurate incident documentation and timely escalations.
• Improved endpoint agent health, security coverage, and operational efficiency.
• Compliance with client security standards and operational procedures.

Ideal Candidate Profile :

The ideal candidate is a hands-on endpoint security professional with extensive L2 operations experience, strong CrowdStrike or EDR expertise, and the ability to independently manage security incidents in an enterprise environment. The candidate should demonstrate sound troubleshooting skills, effective incident coordination, and a proactive approach to improving security operations.

About Solutionara

Solutionara is a U.S.-headquartered IT Consulting & Technology Services firm with a rapidly growing Global Delivery Center in Noida, India. We specialize in enterprise integration, data platforms, cloud engineering, and digital experience technologies. Our clients trust us to modernize their technology landscape, streamline operations, and build data-driven digital products.

At Solutionara, we operate with a builder mindset — high ownership, hands-on problem solving, and a culture where innovation is not a slogan but a standard. If you want to grow in an environment where your work contributes to real enterprise systems and digital platforms, you will thrive here.

Location: Noida, India (On-site – Global Delivery Center, Sector 62)

Experience: 6 – 10 years

Employment Type: Full-time

Role Summary

The IT Systems & Endpoint Lead will be responsible for managing and overseeing Solutionara's endpoint environment, user access, and core IT systems across cloud and on-premise infrastructure. This role combines hands-on system administration with operational ownership, ensuring endpoint compliance, identity governance, and reliable IT operations across the organization. The ideal candidate will act as a key operational anchor, driving stability, enforcing IT policies, and supporting a secure and scalable environment.

Key Responsibilities

Endpoint & Identity Ownership

• Own user identity and access management across Microsoft Entra ID and hybrid Active Directory
• Manage and enforce endpoint compliance using Microsoft Intune
• Ensure consistent enforcement of MFA, Conditional Access, and device policies
• Maintain role-based access control (RBAC) and support periodic access reviews

Infrastructure & Systems Management

• Oversee Windows Server environments and core infrastructure services
• Administer Microsoft 365 services (Exchange Online, Teams, SharePoint, OneDrive)
• Drive patch management, system health monitoring, and uptime reliability
• Identify and implement automation opportunities using PowerShell

IT Operations & Support Oversight

• Handle complex L2/L3 issues and provide escalation support
• Guide junior IT staff or vendors for L1/L2 support activities
• Oversee device provisioning, onboarding, and lifecycle management
• Ensure accurate asset tracking and IT documentation

Security & Compliance Execution

• Ensure enforcement of endpoint security policies (Defender, BitLocker, compliance baselines)
• Support Conditional Access, identity security, and policy enforcement
• Participate in audit readiness, compliance checks, and documentation
• Monitor risks and escalate security gaps proactively

Network & Access Coordination

• Oversee LAN, VPN, and Wi-Fi operations in coordination with network partners
• Maintain access control records, VLANs, and network documentation
• Troubleshoot and resolve advanced connectivity issues

Qualifications & Skills

Education & Experience

• Bachelor's degree in Computer Science, IT, or related field
• 6–10 years of experience in IT infrastructure, endpoint management, or system administration

Core Technical Skills

• Strong hands-on experience with Microsoft Entra ID, Intune, Windows Server, and Microsoft 365
• Experience managing endpoint compliance and identity access
• Solid understanding of Conditional Access, MFA, and access governance
• Good knowledge of networking fundamentals (LAN, VPN, firewall basics)
• Experience with ITSM tools (JIRA, ServiceNow)
• PowerShell scripting for automation and reporting

Preferred Skills

• Exposure to Microsoft Defender (Endpoint / O365)
• Understanding of basic security best practices and audit requirements
• Experience supporting compliance or audit activities

Certifications (Preferred)

• Microsoft Certified: Azure Administrator Associate (AZ-104)
• Microsoft Certified: Modern Desktop Administrator (MD-102)
• CompTIA Security+ / Network+
• ITIL Foundation

Soft Skills

• Strong ownership and accountability mindset
• Good communication and stakeholder coordination skills
• Ability to mentor junior team members
• Structured problem-solving and decision-making ability
• Ability to operate in a fast-paced, evolving environment