• Companies
  • News
By technology
  • Python17.1k
  • AWS11.9k
  • Kubernetes8.5k
  • Docker8.2k
  • C++5.7k
  • PostgreSQL5.4k
  • SQL5.1k
By category
  • Backend Developer11.5k
  • DevOps Engineer3.5k
  • Machine Learning Engineer3.3k
  • Full Stack Developer3.2k
  • Data Engineer2.8k
  • Embedded Engineer2.2k
  • Frontend Developer863
By city
  • San Francisco, CA6.2k
  • New York, NY5.6k
  • Seattle, WA1.3k
  • Washington, DC1.2k
  • Toronto, ON1.2k
  • Boston, MA1k
  • Austin, TX1k
Work mode
  • On-site22k
  • Remote10.2k
  • Hybrid7.3k
Job type
  • Full-time38.2k
  • Contract601
  • Part-time529
  • Freelance215
  • internship4
  • seasonal1
Experience
  • Entry level
  • Mid level
  • Senior
  • Staff+
  • Engineering management

The job board for developers. Find your next role at companies that value great engineering.

© 2023-2026 . All rights reserved.

Logos provided by Logo.dev
Add
5 matches
NewestHighest base
Gruve

Security Operations Analyst (L1) – MS- Defender

today
Gruve · India (Remote)
RemoteFull-timeMicrosoft Defender for Endpoint · Microsoft Defender XDR
Gruve

Endpoint Security Operations Engineer (L2) – Microsoft Defender

today
Gruve · India (Remote)
RemoteFull-timeMicrosoft Defender for Endpoint · Microsoft Defender XDR
Avertium

CyberSecurity Engineer | Microsoft

today
Avertium · Remote, United States
RemoteFull-timeMicrosoft Sentinel · Microsoft Defender XDR
Avertium

CyberSecurity Consultant | Microsoft Azure

today
Avertium · Remote, United States
RemoteFull-timeMicrosoft Azure · Microsoft 365
Avertium

CyberSecurity Consultant | Contractor

today
Avertium · Remote, United States
RemoteContractMicrosoft Azure · Microsoft 365
Gruve

Security Operations Analyst (L1) – MS- Defender

Gruve · India (Remote) · posted today
ApplyFull posting

Extracted from the posting

Base
Not stated
Remote
Shift handovers across APAC, EMEA and NLAM
On-call
Rotational shifts in 24x7 security operations environment
Funding
Described as well-funded early-stage startup; no amount stated
Stack
Microsoft Defender for Endpoint, Microsoft Defender XDR, Microsoft Sentinel, KQL

TL;DR

L1 security operations role monitoring Microsoft Defender alerts, dashboards and incident queues, performing initial triage of malware and endpoint alerts. The analyst logs incidents in ServiceNow, validates Defender sensor health, and escalates to L2/SOC teams. Work follows a 24x7 follow-the-sun model across APAC, EMEA and NLAM shifts.

About Gruve →

The full posting

About Gruve

Gruve is an innovative software services startup dedicated to transforming enterprises to AI powerhouses. We specialize in cybersecurity, customer experience, cloud infrastructure, and advanced technologies such as Large Language Models (LLMs). Our mission is to assist our customers in their business strategies utilizing their data to make more intelligent decisions. As a well-funded early-stage startup, Gruve offers a dynamic environment with strong customer and partner networks.

Position summary:

We are looking for a proactive L1 System Administrator to support day-to-day Microsoft Defender operations. The role is responsible for monitoring security alerts, performing initial triage, validating endpoint protection status, logging incidents and escalating potential threats to L2/L3 teams. The administrator will follow approved security procedures and runbooks to support timely incident response and continuous security monitoring.

Key Responsibilities:

Microsoft Defender Monitoring

  • Monitor Microsoft Defender portals, security dashboards, alerts and incident queues.
  • Perform initial triage of malware detections, suspicious activities and endpoint security alerts.
  • Review alert details, device information, severity and timestamps to assess potential impact.
  • Perform basic checks on Defender sensor health, endpoint onboarding and protection status.
  • Identify endpoints with failed scans, outdated security intelligence or protection-related issues.
  • Escalate suspicious activities and high-severity alerts according to established procedures.

Security Incident & Endpoint Support

  • Create, categorize, prioritize and update security incident tickets in ServiceNow or equivalent ITSM tools.
  • Collect relevant alert evidence, device details, timestamps and investigation information.
  • Perform approved first-level checks using documented security runbooks.
  • Track incidents and coordinate with L2/SOC teams for investigation and remediation.
  • Validate remediation status and endpoint protection recovery as directed.
  • Avoid unauthorized containment or remediation actions and follow established security escalation procedures.

Operations & Service Management

  • Follow Security Incident, Incident, Change and Request Management processes.
  • Ensure timely alert acknowledgement, escalation and SLA compliance.
  • Maintain accurate incident records, operational checklists and shift handover documentation.
  • Coordinate with L2/L3, SOC, Endpoint, Identity and Infrastructure teams.
  • Support routine security reporting, alert tracking and operational reviews.
  • Identify recurring alerts and report monitoring or documentation gaps to L2.
  • Ensure effective APAC–EMEA–NLAM shift handovers and uninterrupted 24x7 monitoring.

Required Skills & Qualifications:

  • 1–3 years of experience in IT operations, security monitoring, endpoint support or security incident management.
  • Basic understanding of endpoint security, antivirus, malware detection and security alerts.
  • Familiarity with Microsoft Defender for Endpoint or equivalent endpoint protection tools.
  • Basic knowledge of Windows operating systems, processes and endpoint health.
  • Ability to review alerts, capture evidence and follow documented investigation procedures.
  • Understanding of incident severity, escalation matrices and SLA requirements.
  • Familiarity with ServiceNow or equivalent ITSM platforms.
  • Good communication, documentation and shift handover skills.
  • Strong attention to detail and adherence to security procedures.
  • Willingness to work in rotational shifts in a 24x7 security operations environment.

Preferred Skills & Qualifications:

  • Microsoft SC-900 or equivalent security fundamentals certification.
  • Basic knowledge of Microsoft Defender XDR and Microsoft Sentinel.
  • Familiarity with malware, phishing, endpoint threats and common attack techniques.
  • Basic PowerShell and Windows troubleshooting knowledge.
  • Exposure to KQL, security dashboards and incident reporting.
  • Understanding of ITIL and security incident management processes.
  • Security Monitoring | Microsoft Defender | Alert Triage | Endpoint Protection | Basic Threat Analysis.
  • Incident Logging | Evidence Collection | Runbook Execution | SLA Compliance.
  • Escalation Management | Shift Handover | Global 24x7 Operations

Why Gruve

At Gruve, we foster a culture of innovation, collaboration, and continuous learning. We are committed to building a diverse and inclusive workplace where everyone can thrive and contribute their best work. If you’re passionate about technology and eager to make an impact, we’d love to hear from you.

Gruve is an equal opportunity employer. We welcome applicants from all backgrounds and thank all who apply; however, only those selected for an interview will be contacted.