Security Operations Analyst (L1) – MS- Defender

Accountabilities:

Monitor Microsoft Defender: Continuously monitor Microsoft Defender portals, security dashboards, alert queues, and incident notifications to identify potential security threats and endpoint protection issues.
Perform initial alert triage: Review malware detections, suspicious activities, and endpoint security alerts, assessing device information, severity levels, timestamps, and potential business impact.
Validate endpoint protection: Perform basic checks on Defender sensor health, endpoint onboarding status, protection configurations, and security coverage.
Identify security vulnerabilities and issues: Detect endpoints with failed scans, outdated security intelligence, inactive sensors, or other protection-related problems and report them through established procedures.
Escalate potential threats: Identify suspicious activities and high-severity alerts and escalate them promptly to L2/L3 analysts and relevant security teams according to established escalation procedures.
Manage security incidents: Create, categorize, prioritize, and update incident tickets using ServiceNow or equivalent IT Service Management platforms.
Collect investigation evidence: Gather and document relevant alert information, device details, timestamps, and initial investigation findings to support further analysis.
Execute security runbooks: Perform approved first-level investigation and validation activities by following documented security procedures and operational guidelines.
Coordinate incident resolution: Track open incidents and collaborate with L2/L3 analysts, SOC teams, and endpoint specialists throughout investigation and remediation activities.
Validate remediation activities: Confirm endpoint protection recovery and remediation status as instructed by senior security teams, ensuring incidents are accurately updated.
Follow security procedures: Respect established authorization boundaries and escalation protocols, avoiding unauthorized containment or remediation actions.
Maintain operational compliance: Follow security incident management, incident, change, and service request processes while ensuring timely alert acknowledgement and SLA compliance.
Document operational activities: Maintain accurate incident records, operational checklists, investigation notes, and shift handover documentation.
Collaborate across teams: Coordinate with SOC, Endpoint, Identity, Infrastructure, and L2/L3 teams to support effective security operations.
Support reporting and improvement: Contribute to routine security reports, alert tracking, and operational reviews while identifying recurring alerts and reporting monitoring or documentation gaps.
Ensure global monitoring continuity: Facilitate effective handovers across APAC, EMEA, and North America teams to maintain uninterrupted 24/7 security monitoring.
Requirements:
Professional experience: 1–3 years of experience in IT operations, security monitoring, endpoint support, or security incident management.
Endpoint security knowledge: Basic understanding of endpoint protection technologies, antivirus solutions, malware detection, and common security alerts.
Microsoft Defender expertise: Familiarity with Microsoft Defender for Endpoint or equivalent endpoint protection platforms. Practical experience with Microsoft Defender is highly desirable.
Windows operating systems: Basic knowledge of Windows environments, system processes, endpoint health, and troubleshooting fundamentals.
Security alert investigation: Ability to review security alerts, identify relevant information, collect evidence, and follow documented investigation procedures.
Incident management: Understanding of incident severity levels, escalation matrices, response procedures, and SLA requirements.
ITSM tools: Familiarity with ServiceNow or equivalent IT Service Management platforms for incident logging, tracking, and documentation.
Communication skills: Good written and verbal communication abilities, with the capacity to provide clear investigation updates and accurate shift handovers.
Documentation and organization: Strong attention to detail and the ability to maintain accurate incident records while following established security procedures.
Shift flexibility: Willingness to work rotational shifts in a 24/7 security operations environment, supporting global teams and continuous monitoring.
Security certifications: Microsoft SC-900 or an equivalent security fundamentals certification is an advantage.
Extended security knowledge: Basic familiarity with Microsoft Defender XDR and Microsoft Sentinel is desirable.
Threat awareness: Understanding of malware, phishing, endpoint threats, and common cyberattack techniques is beneficial.
Scripting and troubleshooting: Basic knowledge of PowerShell and Windows troubleshooting is a plus.
Security analytics: Exposure to Kusto Query Language (KQL), security dashboards, alert analysis, and incident reporting is desirable.
ITIL knowledge: Familiarity with ITIL principles and security incident management processes is an advantage.
Key competencies: Knowledge of security monitoring, Microsoft Defender, alert triage, endpoint protection, basic threat analysis, evidence collection, runbook execution, incident logging, escalation management, SLA compliance, and global 24/7 operations.
Benefits:
Remote flexibility: Fully remote working arrangement within India.
Professional development: Opportunities to develop expertise in cybersecurity, endpoint protection, and enterprise security operations.
Technical exposure: Hands-on experience with Microsoft Defender, security monitoring platforms, incident management tools, and modern security technologies.
Continuous learning: Opportunities to strengthen technical skills through practical security investigations, operational activities, and exposure to emerging threats.
Career progression: Opportunity to grow within security operations and develop advanced incident response and threat investigation capabilities.
Collaborative environment: Work alongside experienced security professionals and international technical teams.
Innovation-driven culture: An environment that encourages curiosity, collaboration, continuous improvement, and knowledge sharing.
Inclusive workplace: A diverse and supportive working environment where different perspectives are valued and employees are encouraged to contribute their best work.