EDR Analyst

Role & responsibilities

• Monitor EDR (Endpoint Detection and Response) systems to identify and respond to potential security incidents on endpoints.
• Collaborate with senior analysts to analyze alerts triggered by EDR tools, evaluating indicators of compromise (IOCs) and unusual activities.
• Assist in the initial investigation of escalated alerts, contributing to the understanding of potential security threats.
• Participate in the forensic analysis of compromised endpoints under the guidance of senior team members.
• Follow established procedures to assist in incident response tasks, supporting the mitigation of threats on endpoints.
• Gain exposure to the development of basic detection rules and queries within EDR platforms.
• Collaborate with cross-functional teams to understand the behavior of malicious files and executables through basic analysis.
• Stay updated on emerging threat trends, contributing insights from EDR data to the collective threat intelligence efforts.
• Work with IT teams to identify potential vulnerabilities or weaknesses in endpoint security configurations.
• Contribute to incident documentation and reporting, providing input on the analysis conducted and actions taken.
• Participate in post-incident reviews to learn from each incident and contribute to refining EDR configurations and response strategies.
• Actively engage in continuous learning to develop expertise in EDR tools, endpoint security, and evolving threat landscapes.

Skills:

      •     Endpoint Detection and Response (EDR)

      •     Endpoint Incident Triage

      •     C Basics

      •     System Logs Analysis

      •     Endpoint Forensics Fundamentals

      •     Security Event Correlation

      •     Attack Techniques Knowledge

Certification (Optional but beneficial):

• CompTIA Security+