Microsoft Security Platform & Compliance

• Support Microsoft Defender portal operations, security policies and endpoint protection configurations within authorized scope.
• Monitor security dashboards, device risk status, protection coverage and sensor health.
• Support onboarding and offboarding of endpoints into Defender in coordination with Endpoint teams.
• Investigate security policy deviations and coordinate corrective actions with the relevant teams.
• Support security reporting, audit evidence collection and compliance activities.

Operations & Service Management

• Resolve security operations incidents within defined SLAs and escalation procedures.
• Follow Incident, Problem, Change and Security Incident Management processes.
• Participate in major incident response, service restoration and post-incident reviews.
• Maintain runbooks, investigation procedures, operational documentation and shift handover notes.
• Coordinate with L1/L3, SOC, Endpoint, Identity, Network and Infrastructure teams.
• Escalate complex threats, platform issues and incidents requiring advanced investigation to L3/SOC.
• Ensure effective APAC–EMEA–NLAM follow-the-sun handovers.

Required Skills & Qualifications:

• 3–6 years of experience in enterprise security operations, Microsoft Defender administration, endpoint protection or security incident support.
• Hands-on experience with Microsoft Defender for Endpoint and its security investigation capabilities.
• Knowledge of endpoint protection, malware detection, threat analysis and security incident handling.
• Experience investigating security alerts, device timelines, suspicious processes and endpoint activity.
• Understanding of Defender onboarding, sensor health, security policies and endpoint protection status.
• Knowledge of Windows operating systems, endpoint administration and basic PowerShell.
• Understanding of incident severity, containment, remediation and escalation procedures.
• Familiarity with Microsoft Defender portal and security monitoring dashboards.
• Experience with ServiceNow or equivalent ITSM tools and incident management processes.
• Strong analytical, documentation and cross-team coordination skills.
• Experience in enterprise 24x7 production or security operations.

Preferred Skills & Qualifications:

• Microsoft SC-200 or equivalent security operations certification.
• Exposure to Microsoft Defender XDR, Microsoft Sentinel and KQL.
• Knowledge of threat hunting, attack techniques and endpoint investigation.
• Familiarity with Microsoft Defender for Identity and Defender for Office 365.
• Experience with vulnerability management, security compliance and incident reporting.
• PowerShell scripting and security operations automation experience.

Key Competencies

Microsoft Defender for Endpoint | Security Alert Investigation | Threat Detection | Endpoint Protection | Incident Response | Threat Remediation | Device Isolation | Sensor Health | Security Compliance | PowerShell | ITSM | Escalation Management | Global 24x7 Operations

Why Gruve

At Gruve, we foster a culture of innovation, collaboration, and continuous learning. We are committed to building a diverse and inclusive workplace where everyone can thrive and contribute their best work. If you’re passionate about technology and eager to make an impact, we’d love to hear from you.

Gruve is an equal opportunity employer. We welcome applicants from all backgrounds and thank all who apply; however, only those selected for an interview will be contacted.