Security Operations Analyst (L1) – MS- Defender

Accountabilities:: Monitor Microsoft Defender: Continuously monitor Microsoft Defender portals, security dashboards, alert queues, and incident notifications to identify potential security threats and endpoint protection issues. Perform initial alert triage: Review malware detections, suspicious activities, and endpoint security alerts, assessing device information, severity levels, timestamps, and potential business impact. Validate endpoint protection: Perform basic checks on Defender sensor health, endpoint onboarding status, protection configurations, and security coverage. Identify security vulnerabilities and issues: Detect endpoints with failed scans, outdated security intelligence, inactive sensors, or other protection-related problems and report them through established procedures. Escalate potential threats: Identify suspicious activities and high-severity alerts and escalate them promptly to L2/L3 analysts and relevant security teams according to established escalation procedures. Manage security incidents: Create, categorize, prioritize, and update incident tickets using ServiceNow or equivalent IT Service Management platforms. Collect investigation evidence: Gather and document relevant alert information, device details, timestamps, and initial investigation findings to support further analysis. Execute security runbooks: Perform approved first-level investigation and validation activities by following documented security procedures and operational guidelines. Coordinate incident resolution: Track open incidents and collaborate with L2/L3 analysts, SOC teams, and endpoint specialists throughout investigation and remediation activities. Validate remediation activities: Confirm endpoint protection recovery and remediation status as instructed by senior security teams, ensuring incidents are accurately updated. Follow security procedures: Respect established authorization boundaries and escalation protocols, avoiding unauthorized containment or remediation actions. Maintain operational compliance: Follow security incident management, incident, change, and service request processes while ensuring timely alert acknowledgement and SLA compliance. Document operational activities: Maintain accurate incident records, operational checklists, investigation notes, and shift handover documentation. Collaborate across teams: Coordinate with SOC, Endpoint, Identity, Infrastructure, and L2/L3 teams to support effective security operations. Support reporting and improvement: Contribute to routine security reports, alert tracking, and operational reviews while identifying recurring alerts and reporting monitoring or documentation gaps. Ensure global monitoring continuity: Facilitate effective handovers across APAC, EMEA, and North America teams to maintain uninterrupted 24/7 security monitoring. Requirements: Professional experience: 1–3 years of experience in IT operations, security monitoring, endpoint support, or security incident management. Endpoint security knowledge: Basic understanding of endpoint protection technologies, antivirus solutions, malware detection, and common security alerts. Microsoft Defender expertise: Familiarity with Microsoft Defender for Endpoint or equivalent endpoint protection platforms. Practical experience with Microsoft Defender is highly desirable. Windows operating systems: Basic knowledge of Windows environments, system processes, endpoint health, and troubleshooting fundamentals. Security alert investigation: Ability to review security alerts, identify relevant information, collect evidence, and follow documented investigation procedures. Incident management: Understanding of incident severity levels, escalation matrices, response procedures, and SLA requirements. ITSM tools: Familiarity with ServiceNow or equivalent IT Service Management platforms for incident logging, tracking, and documentation. Communication skills: Good written and verbal communication abilities, with the capacity to provide clear investigation updates and accurate shift handovers. Documentation and organization: Strong attention to detail and the ability to maintain accurate incident records while following established security procedures. Shift flexibility: Willingness to work rotational shifts in a 24/7 security operations environment, supporting global teams and continuous monitoring. Security certifications: Microsoft SC-900 or an equivalent security fundamentals certification is an advantage. Extended security knowledge: Basic familiarity with Microsoft Defender XDR and Microsoft Sentinel is desirable. Threat awareness: Understanding of malware, phishing, endpoint threats, and common cyberattack techniques is beneficial. Scripting and troubleshooting: Basic knowledge of PowerShell and Windows troubleshooting is a plus. Security analytics: Exposure to Kusto Query Language (KQL), security dashboards, alert analysis, and incident reporting is desirable. ITIL knowledge: Familiarity with ITIL principles and security incident management processes is an advantage. Key competencies: Knowledge of security monitoring, Microsoft Defender, alert triage, endpoint protection, basic threat analysis, evidence collection, runbook execution, incident logging, escalation management, SLA compliance, and global 24/7 operations. Benefits: Remote flexibility: Fully remote working arrangement within India. Professional development: Opportunities to develop expertise in cybersecurity, endpoint protection, and enterprise security operations. Technical exposure: Hands-on experience with Microsoft Defender, security monitoring platforms, incident management tools, and modern security technologies. Continuous learning: Opportunities to strengthen technical skills through practical security investigations, operational activities, and exposure to emerging threats. Career progression: Opportunity to grow within security operations and develop advanced incident response and threat investigation capabilities. Collaborative environment: Work alongside experienced security professionals and international technical teams. Innovation-driven culture: An environment that encourages curiosity, collaboration, continuous improvement, and knowledge sharing. Inclusive workplace: A diverse and supportive working environment where different perspectives are valued and employees are encouraged to contribute their best work.