• Serve as an escalation point for SOC/EDR/XDR alerts and suspected security incidents. • Automate and optimize Incident Response procedures with PowerShell, Python, and scripted API calls. • Write custom detection rules in EDR platforms such as CrowdStrike, SentinelOne, and Microsoft Defender. • Test and deploy EDR agent updates. • Evaluate and implement endpoint and endpoint adjacent security solutions. • Document Incident Response procedures and cross-train technical personnel on those procedures. • Participate in penetration testing and tabletop Incident Response exercises. • Produce and improve security dashboards and reports. • Maintain solution and procedure documentation. • Collaborate with IT, Infrastructure, and Cloud teams to implement secure endpoint configurations and controls. • Identify gaps in endpoint security coverage and recommend remediation or enhancements. • Support vulnerability remediation and endpoint hardening initiatives. • Participate in an on-call rotation, being reachable 24/7 during assigned on-call periods, one week per month. • Coordinate with SOC and IT teams to investigate and resolve high-priority endpoint security incidents during on-call periods.