Job Summary
EDR/Security/WAF SME
Key Responsibilities
Endpoint Protection Architecture (EDR/XDR): Architect, deploy, and manage enterprise-scale Endpoint Detection and Response (EDR/XDR) platforms (e.g., CrowdStrike, Defender for Endpoint, SentinelOne). Design custom threat-hunting queries, manage agent deployment lifecycles, and create automated isolation policies.Application Security Operations (WAF): Take technical ownership of Web Application Firewalls (e.g., Cloudflare, Akamai, Imperva, AWS WAF). Author and tune custom WAF rule sets to defend against the OWASP Top 10, stop automated bot networks, block DDoS attacks, and protect critical APIs without disrupting legitimate user traffic.Network Security Engineering: Design and maintain advanced perimeter security controls, including Next-Generation Firewalls (NGFW), Secure Web Gateways (SWG), intrusion prevention systems (IDS/IPS), and Zero Trust Network Access (ZTNA) frameworks.Policy Tuning & False Positive Reduction: Continuous optimization of threat intelligence feeds and detection rules. Fine-tune EDR policies and WAF signatures to significantly decrease false-positive alerts while ensuring highly accurate blocking capabilities.Incident Escalation & Threat Hunting: Serve as the Tier 3/4 engineering escalation contact for complex security events. Conduct proactive threat-hunting exercises using advanced telemetry and collaborate with the SOC during high-severity containment and remediation efforts.Automation & Integration: Integrate EDR and WAF telemetry with centralized SIEM/SOAR platforms (e.g., Splunk, Microsoft Sentinel). Build automated playbooks (e.g., automated IP blocking, user isolation) to accelerate incident response times
Skill Requirements
Experience: 8+ years of dedicated experience in cybersecurity engineering, security operations, or security architecture.EDR Expertise: Advanced proficiency in deploying, configuring, and maintaining enterprise EDR solutions, with deep knowledge of operating system internals (Windows, Linux, macOS) and endpoint telemetry.WAF & Web Internals Mastery: Expert-level knowledge of HTTP/HTTPS protocols, SSL/TLS management, DNS structures, reverse proxies, and writing precise regular expressions (Regex) or native scripting rules for WAF optimization.Threat Intelligence & Frameworks: Strong practical application of the MITRE ATT&CK; framework, cyber kill chain methodologies, and threat modeling practices.Network Competency: Deep understanding of enterprise TCP/IP networking, routing, load balancers, CDN architectures, and packet analysis tools (Wireshark, tcpdump)