L1 Security Ops Specialist - Defender Endpoint, Purview

Hong Kong Unison Limited; Kuala Lumpur; On-site; MYR 35,000 - 55,000; Full time

Job summary

Hong Kong Unison Limited in Kuala Lumpur seeks an L1 Security Operations Support specialist to manage incidents and tickets across Microsoft Defender for Endpoint, Defender for Cloud Apps, and Purview. You will intake, categorize, prioritize, and begin investigations following approved playbooks.

Responsibilities include reviewing alerts, collecting evidence, and coordinating with L2 teams for complex issues, while maintaining thorough ticket records and customer updates.

Qualifications

• Experience in L1 support, security operations, endpoint support, service desk coordination, or Microsoft 365 operational support.

Responsibilities

• Provide L1 operational support for Defender for Endpoint, Defender for Cloud Apps, and Purview incidents, alerts, requests, and customer tickets.
• Perform initial ticket intake, categorisation, prioritisation, user-impact assessment, and investigation based on guidance.
• Investigate MDE alerts, incidents, device health, onboarding status, and policy deployment.
• Investigate MDCA alerts, user activities, connected applications, and connector health.
• Review Purview alerts and events related to Information Protection, DLP, and Lifecycle Management.
• Collect screenshots, logs, audit records, and evidence required for investigation.
• Maintain clear ticket notes and escalation details within agreed service levels.
• Escalate unresolved or complex issues to L2 or SMEs as needed.

Skills

L1 support

Security operations

Endpoint support

Service desk coordination

Investigation

Escalation management

Runbooks

Evidence collection

Tools

Microsoft Defender for Endpoint

Microsoft Defender for Cloud Apps

Microsoft Purview

Job description

Hong Kong Unison Limited in Kuala Lumpur seeks an L1 Security Operations Support specialist to manage incidents and tickets across Microsoft Defender for Endpoint, Defender for Cloud Apps, and Purview. You will intake, categorize, prioritize, and begin investigations following approved playbooks.

Responsibilities include reviewing alerts, collecting evidence, and coordinating with L2 teams for complex issues, while maintaining thorough ticket records and customer updates.