Security Operations Analyst (L1) – MS- Defender
Core
L1 System Administrator supporting day-to-day Microsoft Defender operations, monitoring security alerts, performing initial triage, and escalating threats.
Role type
L1 SOC Analyst (Endpoint Security)
Builds
Security monitoring and incident response workflows for enterprise endpoints
Domain
Cybersecurity / Endpoint Protection
Deliverable
dashboards & analysis
Required skills
Microsoft Defender for Endpoint, alert triage, incident logging, runbook execution, ServiceNow, Windows OS basics, escalation management, shift handover
Preferred skills
Microsoft Sentinel, KQL, PowerShell, ITIL, malware analysis
Technologies
Microsoft Defender, ServiceNow, Microsoft Sentinel
Responsibilities
Monitor Microsoft Defender portals and security dashboards; Perform initial triage of malware detections and suspicious activities; Create, categorize, and prioritize security incident tickets in ServiceNow; Escalate high-severity alerts to L2/L3 teams; Ensure timely alert acknowledgement and SLA compliance; Coordinate shift handovers for 24x7 monitoring
Seniority
Junior, hands-on IC
