Security Operations Analyst (L1) – MS- Defender

Gruve; San Francisco (CA); On-site; USD 65,000 - 100,000; Full time

Job summary

Gruve is seeking a proactive L1 System Administrator to support day-to-day Microsoft Defender operations in a 24x7 security monitoring role. You will triage alerts, validate endpoint protection, log incidents in ServiceNow, and escalate to L2/L3 teams as needed.

You will work across APAC–EMEA–NLAM shifts, coordinate with SOC and Infrastructure teams, and help ensure timely incident response and ongoing monitoring in a fast-paced startup environment.

Qualifications

• 1–3 years in IT operations, security monitoring, endpoint support or incident management.
• Basic understanding of endpoint security, antivirus, malware detection and security alerts.
• Familiarity with Microsoft Defender for Endpoint or equivalent endpoint protection tools.
• Basic knowledge of Windows operating systems, processes and endpoint health.
• Ability to review alerts, capture evidence and follow documented investigation procedures.
• Understanding of incident severity, escalation matrices and SLA requirements.
• Familiarity with ServiceNow or equivalent ITSM platforms.
• Good communication, documentation and shift handover skills.
• Strong attention to detail and adherence to security procedures.
• Willingness to work in rotational shifts in a 24x7 security operations environment.

Responsibilities

• Monitor Defender portals, security dashboards, alerts and incident queues.
• Perform initial triage of malware detections, suspicious activities and endpoint security alerts.
• Review alert details, device information, severity and timestamps to assess potential impact.
• Perform basic checks on Defender sensor health, endpoint onboarding and protection status.
• Identify endpoints with failed scans, outdated security intelligence or protection-related issues.
• Escalate suspicious activities and high-severity alerts according to established procedures.
• Create, categorize, prioritize and update security incident tickets in ServiceNow or equivalent ITSM tools.
• Collect relevant alert evidence, device details, timestamps and investigation information.
• Perform approved first-level checks using documented security runbooks.
• Track incidents and coordinate with L2/SOC teams for investigation and remediation.
• Validate remediation status and endpoint protection recovery as directed.
• Avoid unauthorized containment or remediation actions and follow established security escalation procedures.
• Follow Security Incident, Incident, Change and Request Management processes.
• Ensure timely alert acknowledgement, escalation and SLA compliance.
• Maintain accurate incident records, operational checklists and shift handover documentation.
• Coordinate with L2/L3, SOC, Endpoint, Identity and Infrastructure teams.
• Support routine security reporting, alert tracking and operational reviews.
• Identify recurring alerts and report monitoring or documentation gaps to L2.
• Ensure effective APAC–EMEA–NLAM shift handovers and uninterrupted 24x7 monitoring.

Skills

IT operations experience

Security monitoring

Incident management

SLA/uptime knowledge

Communication & documentation

Shift work (24x7)

Education

Microsoft SC-900 Certification

Microsoft Defender XDR Certification

Tools

Microsoft Defender for Endpoint

ServiceNow

Windows OS

PowerShell

KQL

Microsoft Defender XDR

Microsoft Sentinel

Job description

About Gruve

Gruve is an innovative software services startup dedicated to transforming enterprises to AI powerhouses. We specialize in cybersecurity, customer experience, cloud infrastructure, and advanced technologies such as Large Language Models (LLMs). Our mission is to assist our customers in their business strategies utilizing their data to make more intelligent decisions. As a well-funded early-stage startup, Gruve offers a dynamic environment with strong customer and partner networks.

Position summary:

We are looking for a proactive L1 System Administrator to support day-to-day Microsoft Defender operations. The role is responsible for monitoring security alerts, performing initial triage, validating endpoint protection status, logging incidents and escalating potential threats to L2/L3 teams. The administrator will follow approved security procedures and runbooks to support timely incident response and continuous security monitoring.

Key Responsibilities:

Microsoft Defender Monitoring

• Monitor Microsoft Defender portals, security dashboards, alerts and incident queues.
• Perform initial triage of malware detections, suspicious activities and endpoint security alerts.
• Review alert details, device information, severity and timestamps to assess potential impact.
• Perform basic checks on Defender sensor health, endpoint onboarding and protection status.
• Identify endpoints with failed scans, outdated security intelligence or protection-related issues.
• Escalate suspicious activities and high-severity alerts according to established procedures.

Security Incident & Endpoint Support

• Create, categorize, prioritize and update security incident tickets in ServiceNow or equivalent ITSM tools.
• Collect relevant alert evidence, device details, timestamps and investigation information.
• Perform approved first-level checks using documented security runbooks.
• Track incidents and coordinate with L2/SOC teams for investigation and remediation.
• Validate remediation status and endpoint protection recovery as directed.
• Avoid unauthorized containment or remediation actions and follow established security escalation procedures.

Operations & Service Management

• Follow Security Incident, Incident, Change and Request Management processes.
• Ensure timely alert acknowledgement, escalation and SLA compliance.
• Maintain accurate incident records, operational checklists and shift handover documentation.
• Coordinate with L2/L3, SOC, Endpoint, Identity and Infrastructure teams.
• Support routine security reporting, alert tracking and operational reviews.
• Identify recurring alerts and report monitoring or documentation gaps to L2.
• Ensure effective APAC–EMEA–NLAM shift handovers and uninterrupted 24x7 monitoring.

Required Skills & Qualifications:

• 1–3 years of experience in IT operations, security monitoring, endpoint support or security incident management.
• Basic understanding of endpoint security, antivirus, malware detection and security alerts.
• Familiarity with Microsoft Defender for Endpoint or equivalent endpoint protection tools.
• Basic knowledge of Windows operating systems, processes and endpoint health.
• Ability to review alerts, capture evidence and follow documented investigation procedures.
• Understanding of incident severity, escalation matrices and SLA requirements.
• Familiarity with ServiceNow or equivalent ITSM platforms.
• Good communication, documentation and shift handover skills.
• Strong attention to detail and adherence to security procedures.
• Willingness to work in rotational shifts in a 24x7 security operations environment.

Preferred Skills & Qualifications:

• Microsoft SC-900 or equivalent security fundamentals certification.
• Basic knowledge of Microsoft Defender XDR and Microsoft Sentinel.
• Familiarity with malware, phishing, endpoint threats and common attack techniques.
• Basic PowerShell and Windows troubleshooting knowledge.
• Exposure to KQL, security dashboards and incident reporting.
• Understanding of ITIL and security incident management processes.
• Security Monitoring | Microsoft Defender | Alert Triage | Endpoint Protection | Basic Threat Analysis.
• Incident Logging | Evidence Collection | Runbook Execution | SLA Compliance.
• Escalation Management | Shift Handover | Global 24x7 Operations

Why Gruve

At Gruve, we foster a culture of innovation, collaboration, and continuous learning. We are committed to building a diverse and inclusive workplace where everyone can thrive and contribute their best work. If you’re passionate about technology and eager to make an impact, we’d love to hear from you.

Gruve is an equal opportunity employer. We welcome applicants from all backgrounds and thank all who apply; however, only those selected for an interview will be contacted.