Security Operations Analyst L1 – MS Defender

This is a fully remote position, open to applicants in India.

📋 Description

• Oversee Microsoft Defender portals, security dashboards, alerts, and incident queues.

• Conduct initial assessments of malware detections, suspicious activities, and endpoint security alerts.

• Analyze alert specifics, device details, severity levels, and timestamps to evaluate potential impact.

• Execute basic checks on Defender sensor health, endpoint onboarding, and protection status.

• Identify endpoints experiencing failed scans, outdated security intelligence, or protection-related problems.

• Escalate suspicious activities and high-severity alerts in accordance with established protocols.

• Create, categorize, prioritize, and update security incident tickets in ServiceNow or similar ITSM tools.

• Gather pertinent alert evidence, device information, timestamps, and investigation details.

• Perform authorized first-level checks utilizing documented security runbooks.

• Track incidents and collaborate with L2/SOC teams for investigation and remediation efforts.

• Confirm remediation status and endpoint protection recovery as directed.

• Adhere to Security Incident, Incident, Change, and Request Management processes.

• Ensure prompt alert acknowledgment, escalation, and compliance with SLAs.

• Maintain precise incident records, operational checklists, and shift handover documentation.

• Collaborate with L2/L3, SOC, Endpoint, Identity, and Infrastructure teams.

• Assist in routine security reporting, alert tracking, and operational reviews.

• Identify recurring alerts and communicate monitoring or documentation deficiencies to L2.

• Ensure effective APAC–EMEA–NLAM shift handovers and uninterrupted 24x7 monitoring.

⛳️ Requirements

• 1–3 years of experience in IT operations, security monitoring, endpoint support, or security incident management.

• Fundamental understanding of endpoint security, antivirus, malware detection, and security alerts.

• Familiarity with Microsoft Defender for Endpoint or equivalent endpoint protection solutions.

• Basic knowledge of Windows operating systems, processes, and endpoint health.

• Capability to review alerts, gather evidence, and adhere to documented investigation protocols.

• Understanding of incident severity, escalation matrices, and SLA requirements.

• Familiarity with ServiceNow or similar ITSM platforms.

• Proficient communication, documentation, and shift handover skills.

• Strong attention to detail and commitment to security procedures.

• Willingness to work rotational shifts in a 24x7 security operations environment.

• Microsoft SC-900 or equivalent security fundamentals certification.

• Basic understanding of Microsoft Defender XDR and Microsoft Sentinel.

• Familiarity with malware, phishing, endpoint threats, and common attack techniques.

• Basic knowledge of PowerShell and Windows troubleshooting.

• Exposure to KQL, security dashboards, and incident reporting.

• Understanding of ITIL and security incident management processes.

🏝️ Benefits

• Dynamic environment with robust customer and partner networks.

• Culture of innovation, collaboration, and continuous learning.

• Diverse and inclusive workplace.

• Equal opportunity employer.