L1 Security Support: Defender for Endpoint & Purview

Unison Group; Kuala Lumpur; On-site; MYR 45,000 - 78,000; Full time

Job summary

Unison Group in Kuala Lumpur seeks an L1 Security Support Analyst to handle incident and ticket triage for Microsoft Defender for Endpoint, Defender for Cloud Apps, and Purview. You will collect data, perform initial investigations, and escalate complex issues to higher levels as needed.

The role requires familiarity with endpoint security tools and adherence to approved runbooks, supporting evidence collection and timely customer updates.

Qualifications

• Experience in L1 support or security operations.
• Working knowledge of Defender for Endpoint, Defender for Cloud Apps, and Purview.
• Ability to perform initial investigation of incidents, alerts, and tickets.
• Ability to follow runbooks, knowledge articles, and escalation procedures without unauthorised production changes.

Responsibilities

• Provide L1 operational support for Microsoft Defender for Endpoint, Defender for Cloud Apps, and Purview incidents, alerts, requests, and customer tickets.
• Perform initial ticket intake, categorisation, prioritisation, user-impact assessment, and investigation.
• Investigate MDE alerts, incidents, device timelines, antivirus detections, device health, onboarding status, and policy status.
• Investigate MDCA alerts, user activities, connected applications, cloud-discovery information, policies, anomaly detections, and connector health.
• Review Purview alerts and events related to Information Protection, sensitivity labels, DLP, Endpoint DLP, Insider Risk Management, and Data Lifecycle Management.
• Collect screenshots, diagnostic packages, logs, alert details, policy status, connector status, audit records, and validation outputs for investigations.
• Maintain ticket notes, investigation findings, supporting evidence, customer updates, escalation details, and closure information within SLAs.

Skills

L1 Support

Security Operations

Endpoint Support

Service Desk

Microsoft 365

Defender for Endpoint

Defender for Cloud Apps

Purview

Incident Investigation

Log Collection

Job description

Unison Group in Kuala Lumpur seeks an L1 Security Support Analyst to handle incident and ticket triage for Microsoft Defender for Endpoint, Defender for Cloud Apps, and Purview. You will collect data, perform initial investigations, and escalate complex issues to higher levels as needed.

The role requires familiarity with endpoint security tools and adherence to approved runbooks, supporting evidence collection and timely customer updates.