Security Operations Analyst (L1) – MS- Defender

Gruve; India; Remote; INR 420,000 - 620,000; Full time

Job summary

Gruve Inc. is seeking a proactive Security Operations Analyst (L1) to support Microsoft Defender operations from India (Remote). The role involves monitoring security alerts, triage, and escalating threats to L2/L3.

You will follow approved security playbooks and work with ITSM tools to track incidents and maintain 24x7 monitoring across APAC–EMEA regions. The ideal candidate has 1–3 years’ experience in IT operations or security monitoring, familiarity with Defender for Endpoint, Windows OS,

Qualifications

• 1–3 years of experience in IT operations, security monitoring or incident management.
• Experience with endpoint protection tools and alert triage.
• Familiarity with incident escalation, SLA and shift handovers.

Responsibilities

• Monitor Defender portals, dashboards, alerts and incident queues.
• Perform initial triage of malware detections and endpoint alerts.
• Review alert details, device information, severity and timestamps.

Skills

Security monitoring

Endpoint support

Incident management

Documentation

Communication

Windows OS knowledge

Shift work

Tools

ServiceNow ITSM

Microsoft Defender for Endpoint

PowerShell

KQL

Job description

Security Operations Analyst (L1) – MS- Defender

India (Remote)

Gruve is an innovative software services startup dedicated to transforming enterprises to AI powerhouses. We specialize in cybersecurity, customer experience, cloud infrastructure, and advanced technologies such as Large Language Models (LLMs). Our mission is to assist our customers in their business strategies utilizing their data to make more intelligent decisions. As a well-funded early-stage startup, Gruve offers a dynamic environment with strong customer and partner networks.

Position summary:

We are looking for a proactive L1 System Administrator to support day-to-day Microsoft Defender operations. The role is responsible for monitoring security alerts, performing initial triage, validating endpoint protection status, logging incidents and escalating potential threats to L2/L3 teams. The administrator will follow approved security procedures and runbooks to support timely incident response and continuous security monitoring.

Key Responsibilities:

• Monitor Microsoft Defender portals, security dashboards, alerts and incident queues.
• Perform initial triage of malware detections, suspicious activities and endpoint security alerts.
• Review alert details, device information, severity and timestamps to assess potential impact.
• Perform basic checks on Defender sensor health, endpoint onboarding and protection status.
• Identify endpoints with failed scans, outdated security intelligence or protection-related issues.
• Escalate suspicious activities and high-severity alerts according to established procedures.

Security Incident & Endpoint Support

• Create, categorize, prioritize and update security incident tickets in ServiceNow or equivalent ITSM tools.
• Collect relevant alert evidence, device details, timestamps and investigation information.
• Perform approved first-level checks using documented security runbooks.
• Track incidents and coordinate with L2/SOC teams for investigation and remediation.
• Validate remediation status and endpoint protection recovery as directed.
• Avoid unauthorized containment or remediation actions and follow established security escalation procedures.

Operations & Service Management

• Follow Security Incident, Incident, Change and Request Management processes.
• Ensure timely alert acknowledgement, escalation and SLA compliance.
• Maintain accurate incident records, operational checklists and shift handover documentation.
• Coordinate with L2/L3, SOC, Endpoint, Identity and Infrastructure teams.
• Support routine security reporting, alert tracking and operational reviews.
• Identify recurring alerts and report monitoring or documentation gaps to L2.
• Ensure effective APAC–EMEA–NLAM shift handovers and uninterrupted 24x7 monitoring.

Required Skills & Qualifications:

• 1–3 years of experience in IT operations, security monitoring, endpoint support or security incident management.
• Basic understanding of endpoint security, antivirus, malware detection and security alerts.
• Familiarity with Microsoft Defender for Endpoint or equivalent endpoint protection tools.
• Basic knowledge of Windows operating systems, processes and endpoint health.
• Ability to review alerts, capture evidence and follow documented investigation procedures.
• Understanding of incident severity, escalation matrices and SLA requirements.
• Familiarity with ServiceNow or equivalent ITSM platforms.
• Good communication, documentation and shift handover skills.
• Strong attention to detail and adherence to security procedures.
• Willingness to work in rotational shifts in a 24x7 security operations environment.

Preferred Skills & Qualifications:

• Microsoft SC-900 or equivalent security fundamentals certification.
• Basic knowledge of Microsoft Defender XDR and Microsoft Sentinel.
• Familiarity with malware, phishing, endpoint threats and common attack techniques.
• Basic PowerShell and Windows troubleshooting knowledge.
• Exposure to KQL, security dashboards and incident reporting.
• Understanding of ITIL and security incident management processes.
• Security Monitoring | Microsoft Defender | Alert Triage | Endpoint Protection | Basic Threat Analysis.
• Incident Logging | Evidence Collection | Runbook Execution | SLA Compliance.
• Escalation Management | Shift Handover | Global 24x7 Operations

Why Gruve

At Gruve, we foster a culture of innovation, collaboration, and continuous learning. We are committed to building a diverse and inclusive workplace where everyone can thrive and contribute their best work. If you’re passionate about technology and eager to make an impact, we’d love to hear from you.

Gruve is an equal opportunity employer. We welcome applicants from all backgrounds and thank all who apply; however, only those selected for an interview will be contacted.