L1 Support SME - Microsoft Defender for Endpoint, MDCA & Purview

Unison Group; Kuala Lumpur; On-site; MYR 45,000 - 78,000; Full time

Job summary

Unison Group in Kuala Lumpur seeks an L1 Security Support Analyst to handle incident and ticket triage for Microsoft Defender for Endpoint, Defender for Cloud Apps, and Purview. You will collect data, perform initial investigations, and escalate complex issues to higher levels as needed.

The role requires familiarity with endpoint security tools and adherence to approved runbooks, supporting evidence collection and timely customer updates.

Qualifications

• Experience in L1 support or security operations.
• Working knowledge of Defender for Endpoint, Defender for Cloud Apps, and Purview.
• Ability to perform initial investigation of incidents, alerts, and tickets.
• Ability to follow runbooks, knowledge articles, and escalation procedures without unauthorised production changes.

Responsibilities

• Provide L1 operational support for Microsoft Defender for Endpoint, Defender for Cloud Apps, and Purview incidents, alerts, requests, and customer tickets.
• Perform initial ticket intake, categorisation, prioritisation, user-impact assessment, and investigation.
• Investigate MDE alerts, incidents, device timelines, antivirus detections, device health, onboarding status, and policy status.
• Investigate MDCA alerts, user activities, connected applications, cloud-discovery information, policies, anomaly detections, and connector health.
• Review Purview alerts and events related to Information Protection, sensitivity labels, DLP, Endpoint DLP, Insider Risk Management, and Data Lifecycle Management.
• Collect screenshots, diagnostic packages, logs, alert details, policy status, connector status, audit records, and validation outputs for investigations.
• Maintain ticket notes, investigation findings, supporting evidence, customer updates, escalation details, and closure information within SLAs.

Skills

L1 Support

Security Operations

Endpoint Support

Service Desk

Microsoft 365

Defender for Endpoint

Defender for Cloud Apps

Purview

Incident Investigation

Log Collection

Job description

• Provide L1 operational support for Microsoft Defender for Endpoint, Microsoft Defender for Cloud Apps, and Microsoft Purview incidents, alerts, requests, and customer tickets.
• Perform initial ticket intake, categorisation, prioritisation, user-impact assessment, and investigation based on available evidence and approved support guidance.
• Investigate MDE alerts, incidents, device timelines, antivirus detections, device health, onboarding status, sensor health, and endpoint policy status.
• Investigate MDCA alerts, user activities, connected applications, cloud-discovery information, activity policies, anomaly detections, and connector health.
• Review Purview alerts and events related to Information Protection, sensitivity labels, Data Loss Prevention, Endpoint DLP, Insider Risk Management, and Data Lifecycle Management.
• Collect screenshots, diagnostic packages, logs, alert details, policy status, connector status, audit records, and validation outputs required for issue investigation.
• Perform basic runbook-based troubleshooting and elevate unresolved or complex issues to L2, L3, platform SMEs, Microsoft Support, or relevant client teams.
• Maintain clear ticket notes, investigation findings, supporting evidence, customer updates, escalation details, and closure information within agreed service levels.

• Experience in L1 support, security operations, endpoint support, service desk coordination, or Microsoft 365 operational support.
• Working knowledge of Microsoft Defender for Endpoint, Microsoft Defender for Cloud Apps, Microsoft Purview, and their respective management portals.
• Ability to perform initial investigation of MDE incidents, alerts, device timelines, endpoint health, onboarding status, and policy deployment.
• Ability to review MDCA alerts, activities, connected applications, policies, cloud-discovery information, and connector status.
• Familiarity with Purview Information Protection, sensitivity labels, DLP, Endpoint DLP, Insider Risk Management, and Data Lifecycle Management.
• Understanding of customer-ticket handling, alert triage, log collection, evidence documentation, escalation management, and issue lifecycle tracking.
• Ability to follow approved runbooks, knowledge articles, support guides, and escalation procedures without making unauthorised production changes.