Security Operations Analyst (L1) – MS- Defender
Core
Monitor Microsoft Defender security alerts, perform initial triage and investigations, and escalate threats to maintain enterprise endpoint security.
Role type
L1 Security Operations Analyst (Endpoint Security)
Builds
Enterprise IT security posture via continuous monitoring and incident response
Domain
Cybersecurity / Endpoint Protection
Required skills
Microsoft Defender for Endpoint, alert triage, incident management, ServiceNow, Windows troubleshooting, evidence collection, runbook execution, escalation management, SLA compliance, shift handover
Preferred skills
Microsoft SC-900, KQL, PowerShell, Microsoft Sentinel, Microsoft Defender XDR, ITIL
Technologies
Microsoft Defender, ServiceNow, Windows, KQL, PowerShell, Microsoft Sentinel, Microsoft Defender XDR
Responsibilities
Monitor Microsoft Defender portals and alert queues, perform initial alert triage for malware and suspicious activities, validate endpoint protection status and sensor health, escalate high-severity alerts to L2/L3 teams, create and update incident tickets in ServiceNow, collect investigation evidence, execute security runbooks, coordinate incident resolution with SOC teams, validate remediation activities, document operational activities and shift handovers, ensure 24/7 global monitoring continuity
Seniority
Junior, hands-on IC
