L1 Security Operations Analyst – Monitoring & Triage

Gruve; San Francisco (CA); On-site; USD 65,000 - 100,000; Full time

Job summary

Gruve is seeking a proactive L1 System Administrator to support day-to-day Microsoft Defender operations in a 24x7 security monitoring role. You will triage alerts, validate endpoint protection, log incidents in ServiceNow, and escalate to L2/L3 teams as needed.

You will work across APAC–EMEA–NLAM shifts, coordinate with SOC and Infrastructure teams, and help ensure timely incident response and ongoing monitoring in a fast-paced startup environment.

Qualifications

• 1–3 years in IT operations, security monitoring, endpoint support or incident management.
• Basic understanding of endpoint security, antivirus, malware detection and security alerts.
• Familiarity with Microsoft Defender for Endpoint or equivalent endpoint protection tools.
• Basic knowledge of Windows operating systems, processes and endpoint health.
• Ability to review alerts, capture evidence and follow documented investigation procedures.
• Understanding of incident severity, escalation matrices and SLA requirements.
• Familiarity with ServiceNow or equivalent ITSM platforms.
• Good communication, documentation and shift handover skills.
• Strong attention to detail and adherence to security procedures.
• Willingness to work in rotational shifts in a 24x7 security operations environment.

Responsibilities

• Monitor Defender portals, security dashboards, alerts and incident queues.
• Perform initial triage of malware detections, suspicious activities and endpoint security alerts.
• Review alert details, device information, severity and timestamps to assess potential impact.
• Perform basic checks on Defender sensor health, endpoint onboarding and protection status.
• Identify endpoints with failed scans, outdated security intelligence or protection-related issues.
• Escalate suspicious activities and high-severity alerts according to established procedures.
• Create, categorize, prioritize and update security incident tickets in ServiceNow or equivalent ITSM tools.
• Collect relevant alert evidence, device details, timestamps and investigation information.
• Perform approved first-level checks using documented security runbooks.
• Track incidents and coordinate with L2/SOC teams for investigation and remediation.
• Validate remediation status and endpoint protection recovery as directed.
• Avoid unauthorized containment or remediation actions and follow established security escalation procedures.
• Follow Security Incident, Incident, Change and Request Management processes.
• Ensure timely alert acknowledgement, escalation and SLA compliance.
• Maintain accurate incident records, operational checklists and shift handover documentation.
• Coordinate with L2/L3, SOC, Endpoint, Identity and Infrastructure teams.
• Support routine security reporting, alert tracking and operational reviews.
• Identify recurring alerts and report monitoring or documentation gaps to L2.
• Ensure effective APAC–EMEA–NLAM shift handovers and uninterrupted 24x7 monitoring.

Skills

IT operations experience

Security monitoring

Incident management

SLA/uptime knowledge

Communication & documentation

Shift work (24x7)

Education

Microsoft SC-900 Certification

Microsoft Defender XDR Certification

Tools

Microsoft Defender for Endpoint

ServiceNow

Windows OS

PowerShell

KQL

Microsoft Defender XDR

Microsoft Sentinel

Job description

Gruve is seeking a proactive L1 System Administrator to support day-to-day Microsoft Defender operations in a 24x7 security monitoring role. You will triage alerts, validate endpoint protection, log incidents in ServiceNow, and escalate to L2/L3 teams as needed.

You will work across APAC–EMEA–NLAM shifts, coordinate with SOC and Infrastructure teams, and help ensure timely incident response and ongoing monitoring in a fast-paced startup environment.