This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Security Operations Analyst (L1) – MS Defender based in India.
As a Security Operations Analyst, you will play an important role in protecting enterprise IT environments through continuous security monitoring and first-level incident response. You will be responsible for monitoring Microsoft Defender security alerts, identifying suspicious activities, and performing initial investigations to help detect potential threats. Working within a global security operations environment, you will support endpoint protection, validate device security status, and ensure incidents are properly documented and escalated. You will collaborate with SOC specialists, infrastructure teams, and senior security analysts to support effective threat detection and response. By following established security procedures and operational runbooks, you will contribute to maintaining a strong security posture across enterprise environments. This is an excellent opportunity to develop your cybersecurity expertise in a collaborative, fast-paced, and continuously evolving technical environment.
- Monitor Microsoft Defender: Continuously monitor Microsoft Defender portals, security dashboards, alert queues, and incident notifications to identify potential security threats and endpoint protection issues.
- Perform initial alert triage: Review malware detections, suspicious activities, and endpoint security alerts, assessing device information, severity levels, timestamps, and potential business impact.
- Validate endpoint protection: Perform basic checks on Defender sensor health, endpoint onboarding status, protection configurations, and security coverage.
- Identify security vulnerabilities and issues: Detect endpoints with failed scans, outdated security intelligence, inactive sensors, or other protection-related problems and report them through established procedures.
- Escalate potential threats: Identify suspicious activities and high-severity alerts and escalate them promptly to L2/L3 analysts and relevant security teams according to established escalation procedures.
- Manage security incidents: Create, categorize, prioritize, and update incident tickets using ServiceNow or equivalent IT Service Management platforms.
- Collect investigation evidence: Gather and document relevant alert information, device details, timestamps, and initial investigation findings to support further analysis.
- Execute security runbooks: Perform approved first-level investigation and validation activities by following documented security procedures and operational guidelines.
- Coordinate incident resolution: Track open incidents and collaborate with L2/L3 analysts, SOC teams, and endpoint specialists throughout investigation and remediation activities.
- Validate remediation activities: Confirm endpoint protection recovery and remediation status as instructed by senior security teams, ensuring incidents are accurately updated.
- Follow security procedures: Respect established authorization boundaries and escalation protocols, avoiding unauthorized containment or remediation actions.
- Maintain operational compliance: Follow security incident management, incident, change, and service request processes while ensuring timely alert acknowledgement and SLA compliance.
- Document operational activities: Maintain accurate incident records, operational checklists, investigation notes, and shift handover documentation.
- Collaborate across teams: Coordinate with SOC, Endpoint, Identity, Infrastructure, and L2/L3 teams to support effective security operations.
- Support reporting and improvement: Contribute to routine security reports, alert tracking, and operational reviews while identifying recurring alerts and reporting monitoring or documentation gaps.
- Ensure global monitoring continuity: Facilitate effective handovers across APAC, EMEA, and North America teams to maintain uninterrupted 24/7 security monitoring.
Requirements:
- Professional experience: 1–3 years of experience in IT operations, security monitoring, endpoint support, or security incident management.
- Endpoint security knowledge: Basic understanding of endpoint protection technologies, antivirus solutions, malware detection, and common security alerts.
- Microsoft Defender expertise: Familiarity with Microsoft Defender for Endpoint or equivalent endpoint protection platforms. Practical experience with Microsoft Defender is highly desirable.
- Windows operating systems: Basic knowledge of Windows environments, system processes, endpoint health, and troubleshooting fundamentals.
- Security alert investigation: Ability to review security alerts, identify relevant information, collect evidence, and follow documented investigation procedures.
- Incident management: Understanding of incident severity levels, escalation matrices, response procedures, and SLA requirements.
- ITSM tools: Familiarity with ServiceNow or equivalent IT Service Management platforms for incident logging, tracking, and documentation.
- Communication skills: Good written and verbal communication abilities, with the capacity to provide clear investigation updates and accurate shift handovers.
- Documentation and organization: Strong attention to detail and the ability to maintain accurate incident records while following established security procedures.
- Shift flexibility: Willingness to work rotational shifts in a 24/7 security operations environment, supporting global teams and continuous monitoring.
- Security certifications: Microsoft SC-900 or an equivalent security fundamentals certification is an advantage.
- Extended security knowledge: Basic familiarity with Microsoft Defender XDR and Microsoft Sentinel is desirable.
- Threat awareness: Understanding of malware, phishing, endpoint threats, and common cyberattack techniques is beneficial.
- Scripting and troubleshooting: Basic knowledge of PowerShell and Windows troubleshooting is a plus.
- Security analytics: Exposure to Kusto Query Language (KQL), security dashboards, alert analysis, and incident reporting is desirable.
- ITIL knowledge: Familiarity with ITIL principles and security incident management processes is an advantage.
- Key competencies: Knowledge of security monitoring, Microsoft Defender, alert triage, endpoint protection, basic threat analysis, evidence collection, runbook execution, incident logging, escalation management, SLA compliance, and global 24/7 operations.
Benefits:
- Remote flexibility: Fully remote working arrangement within India.
- Professional development: Opportunities to develop expertise in cybersecurity, endpoint protection, and enterprise security operations.
- Technical exposure: Hands-on experience with Microsoft Defender, security monitoring platforms, incident management tools, and modern security technologies.
- Continuous learning: Opportunities to strengthen technical skills through practical security investigations, operational activities, and exposure to emerging threats.
- Career progression: Opportunity to grow within security operations and develop advanced incident response and threat investigation capabilities.
- Collaborative environment: Work alongside experienced security professionals and international technical teams.
- Innovation-driven culture: An environment that encourages curiosity, collaboration, continuous improvement, and knowledge sharing.
- Inclusive workplace: A diverse and supportive working environment where different perspectives are valued and employees are encouraged to contribute their best work.
