Endpoint Security Specialist
First seen by Alion on Oct 1, 2026.
Key Roles & Responsibilities :
- Continuous Alert Monitoring & Triage : Monitor high-volume alerts from WAF (application layer attacks), EDR (endpoint/host anomalies), and SSE (data loss, malicious web traffic, unauthorized cloud application usage) via our SIEM/SOAR platform.
- Deep-Dive Investigation : Analyze security events to determine root cause. Validate if anomalous endpoint behavior, suspicious web requests, or strange cloud data access represents a true positive threat or a benign business action.
- WAF Tuning & Management : Review WAF blocks and alerts (e.g., SQLi, XSS, automated bot traffic). Coordinate with application teams to tune false positives and optimize WAF rule sets without disrupting legitimate traffic.
- Endpoint Incident Containment : Leverage EDR tools to isolate compromised endpoints, kill malicious processes, harvest forensic artifacts, and investigate execution chains (e.g., malicious PowerShell, process injection).
- SSE & Data Security Enforcement : Track anomalies in data movement and web gateways. Identify shadow IT, potential data exfiltration vectors, and violations of our Zero Trust Network Access (ZTNA) policies.
- Reporting & Documentation : Document comprehensive investigation timelines and findings in our ticketing system. Create weekly/monthly metrics reporting on alert volumes, true vs. false-positive ratios, threat trends, and time-to-remediate.
- Playbook Optimization : Work closely with senior security engineers to automate repetitive triage tasks by developing and refining SOAR (Security Orchestration, Automation, and Response) playbooks.
Education & Certificates :
- Bachelor's degree - BTech or equivalent.
Technical Skills :
- Experience : 2 - 4+ years of dedicated SOC, MDR, or specialized security monitoring experience focusing on endpoint and web application defenses.
- EDR Tool Proficiency : Deep, practical experience using major EDR/XDR platforms (e.g., CrowdStrike Falcon, SentinelOne, Microsoft Defender for Endpoint, Carbon Black).
- WAF Experience : Solid understanding of HTTP/HTTPS protocols, the OWASP Top 10, and experience triaging alerts or adjusting rules in enterprise WAFs (e.g., Cloudflare, Akamai, AWS WAF, Imperva).
- SSE/SASE Literacy : Familiarity with Security Service Edge architectures, including Secure Web Gateways (SWG), Cloud Access Security Brokers (CASB), and Zero Trust Network Access (ZTNA) solutions (e.g., Zscaler, Netskope, Palo Alto Prisma).
- Log & Packet Analysis : Strong capability in reading and interpreting security event logs, syslogs, application logs, and analyzing network traffic patterns.
- Analytical Mindset : Excellent investigative skills with the ability to correlate seemingly unrelated alerts (e.g., a WAF alert followed by a specific EDR process launch) to map out an adversary's footprint.
Skills
WAF, Security, SIEM, SOAR, Endpoint Detection & Response, Cyber Security, HTTP, HTTPS, Sentinel