Security Operations Analyst (L1) – MS- Defender

Position summary:

We are looking for a proactive L1 System Administrator to support day-to-day Microsoft Defender operations. The role is responsible for monitoring security alerts, performing initial triage, validating endpoint protection status, logging incidents and escalating potential threats to L2/L3 teams. The administrator will follow approved security procedures and runbooks to support timely incident response and continuous security monitoring.

Key Responsibilities:

Microsoft Defender Monitoring

• Monitor Microsoft Defender portals, security dashboards, alerts and incident queues.
• Perform initial triage of malware detections, suspicious activities and endpoint security alerts.
• Review alert details, device information, severity and timestamps to assess potential impact.
• Perform basic checks on Defender sensor health, endpoint onboarding and protection status.
• Identify endpoints with failed scans, outdated security intelligence or protection-related issues.
• Escalate suspicious activities and high-severity alerts according to established procedures.

 Security Incident & Endpoint Support

• Create, categorize, prioritize and update security incident tickets in ServiceNow or equivalent ITSM tools.
• Collect relevant alert evidence, device details, timestamps and investigation information.
• Perform approved first-level checks using documented security runbooks.
• Track incidents and coordinate with L2/SOC teams for investigation and remediation.
• Validate remediation status and endpoint protection recovery as directed.
• Avoid unauthorized containment or remediation actions and follow established security escalation procedures.

 Operations & Service Management

• Follow Security Incident, Incident, Change and Request Management processes.
• Ensure timely alert acknowledgement, escalation and SLA compliance.
• Maintain accurate incident records, operational checklists and shift handover documentation.
• Coordinate with L2/L3, SOC, Endpoint, Identity and Infrastructure teams.
• Support routine security reporting, alert tracking and operational reviews.
• Identify recurring alerts and report monitoring or documentation gaps to L2.
• Ensure effective APAC–EMEA–NLAM shift handovers and uninterrupted 24x7 monitoring.

Required Skills & Qualifications:

• 1–3 years of experience in IT operations, security monitoring, endpoint support or security incident management. 
• Basic understanding of endpoint security, antivirus, malware detection and security alerts.
• Familiarity with Microsoft Defender for Endpoint or equivalent endpoint protection tools.
• Basic knowledge of Windows operating systems, processes and endpoint health.
• Ability to review alerts, capture evidence and follow documented investigation procedures.
• Understanding of incident severity, escalation matrices and SLA requirements.
• Familiarity with ServiceNow or equivalent ITSM platforms.
• Good communication, documentation and shift handover skills.
• Strong attention to detail and adherence to security procedures.
• Willingness to work in rotational shifts in a 24x7 security operations environment.

Preferred Skills & Qualifications:

• Microsoft SC-900 or equivalent security fundamentals certification.
• Basic knowledge of Microsoft Defender XDR and Microsoft Sentinel.
• Familiarity with malware, phishing, endpoint threats and common attack techniques.
• Basic PowerShell and Windows troubleshooting knowledge.
• Exposure to KQL, security dashboards and incident reporting.
• Understanding of ITIL and security incident management processes.
• Security Monitoring | Microsoft Defender | Alert Triage | Endpoint Protection | Basic Threat Analysis.
• Incident Logging | Evidence Collection | Runbook Execution | SLA Compliance.
• Escalation Management | Shift Handover | Global 24x7 Operations