L2 Operations Lead – Malware Tools

Job Title : L2 Operations Lead – Malware Tools

Experience : 10+ Years

Location : Gurugram

Work Mode : Hybrid – 2 Days in Office

Employment Type : Full-Time

Engagement Duration : 6+ Months

Number of Positions : 1

Support Level : L2 Operations

Domain : Endpoint Security & Malware Protection

About the Role :

We are looking for an experienced L2 Operations Lead – Malware Tools to manage and support enterprise endpoint protection and malware security platforms, with a primary focus on CrowdStrike. The ideal candidate will have strong expertise in endpoint detection and response (EDR), malware investigation, incident management, and endpoint security operations.

The role involves monitoring security platforms in a 24×7×365 support environment, resolving Level 2 incidents, troubleshooting endpoint security agents, and escalating complex issues to L3 teams when required. The candidate will also collaborate with cross-functional security and infrastructure teams to maintain effective endpoint protection and minimize recurring incidents.

Mandatory Skills :

CrowdStrike Falcon, EDR, Endpoint Security, Malware Detection & Investigation, Alert Triage, Threat Containment, Microsoft Defender, ServiceNow, SIEM/SOAR (Splunk), Windows Server, Incident Management, 24×7 Operations Support, and Python/PowerShell Scripting.

Key Responsibilities :

• Manage end-to-end security incident handling, from L1/L1.5 escalation through investigation, resolution, and closure.
• Monitor and support endpoint protection and malware security platforms in a 24×7×365 operational environment.
• Administer and maintain CrowdStrike Falcon and other endpoint detection and response (EDR) solutions.
• Investigate malware alerts, perform alert triage, assess risks, and implement appropriate containment and remediation actions.
• Troubleshoot endpoint security agent issues, including installation, deployment, connectivity, health monitoring, and performance.
• Install, configure, update, and maintain antivirus and endpoint protection solutions across servers.
• Manage endpoint security consoles, agent updates, patching, platform upgrades, and configuration changes.
• Escalate complex incidents to L3 teams with detailed investigation findings, impact assessments, and recommended actions.
• Maintain accurate and up-to-date incident records in ServiceNow, including investigation details, resolution steps, and closure notes.
• Participate in Root Cause Analysis (RCA) reviews and implement corrective and preventive measures.
• Develop and maintain Standard Operating Procedures (SOPs), troubleshooting guides, and knowledge-base articles.
• Analyze incident trends and recurring alerts to improve detection effectiveness and reduce repeated incidents.
• Collaborate with DLP, Hosting, Network Security, Identity and Access Management (IDAM), and other infrastructure teams to resolve cross-functional issues.
• Ensure compliance with client security policies, operational procedures, and established service-level agreements (SLAs).
• Provide clear incident updates, communicate security risks promptly, and recommend appropriate mitigation measures.

Required Technical Skills :

• Endpoint Security & EDR : Strong hands-on experience with endpoint protection, antivirus, and EDR technologies.
• CrowdStrike Falcon : Experience in administration, monitoring, policy management, alert investigation, and agent troubleshooting.
• Microsoft Defender : Knowledge of endpoint protection and malware detection capabilities.
• Malware Investigation : Expertise in alert triage, threat analysis, risk assessment, containment, and remediation.
• ITSM : Experience with incident, problem, and change management processes.
• Security Monitoring : Familiarity with SIEM/SOAR platforms and security event analysis.
• Operating Systems : Strong knowledge of Windows operating systems and endpoint security administration.
• Scripting : Basic to intermediate scripting knowledge in Python or PowerShell for troubleshooting and operational automation.
• Monitoring Tools : Familiarity with Splunk, DataDog, and related monitoring or security operations tools.

Tools & Technologies :

• CrowdStrike Falcon
• Microsoft Defender
• ServiceNow
• Splunk SIEM
• SOAR Platforms
• DataDog
• Antivirus and Endpoint Detection & Response (EDR) Solutions
• Windows Server and Windows Operating Systems
• Python / PowerShell

Required Experience & Qualifications :

• 10+ years of overall experience in IT operations, endpoint security, or related security operations functions, with strong hands-on L2 endpoint security experience.
• Proven experience supporting endpoint protection and malware security tools in an enterprise environment.
• Hands-on experience with CrowdStrike Falcon or other enterprise EDR solutions.
• Experience troubleshooting endpoint security agents and resolving security incidents.
• Strong understanding of malware investigation, alert triage, threat containment, and escalation procedures.
• Experience working in a 24×7 operational support environment.
• Good understanding of ITSM processes, including incident, problem, and change management.
• Experience maintaining operational documentation, SOPs, RCA reports, and knowledge-base articles.
• Strong analytical, troubleshooting, and problem-solving skills.
• Excellent written and verbal English communication skills.
• Ability to coordinate effectively with L1, L3, and cross-functional infrastructure and security teams.

Preferred Certifications :

• CrowdStrike Falcon Administrator
• Microsoft Certified: Security Operations Analyst Associate (SC-200)
• CompTIA Security+

Key Performance Expectations :

• Timely resolution of L2 incidents within defined SLAs.
• Effective investigation and containment of malware and endpoint security threats.
• Reduced recurrence of incidents through RCA and preventive actions.
• Accurate incident documentation and timely escalations.
• Improved endpoint agent health, security coverage, and operational efficiency.
• Compliance with client security standards and operational procedures.

Ideal Candidate Profile :

The ideal candidate is a hands-on endpoint security professional with extensive L2 operations experience, strong CrowdStrike or EDR expertise, and the ability to independently manage security incidents in an enterprise environment. The candidate should demonstrate sound troubleshooting skills, effective incident coordination, and a proactive approach to improving security operations.

Skills

CrowdStrike Falcon, Endpoint detection and response, Endpoint Security, Malware Detection, Malware Investigation, Alert Triage, Threat Containment, Microsoft Defender, ServiceNow, Security Information and Event Management (SIEM), Splunk, Microsoft Windows Server, Incident management, Operations support system, Powershell