{"id":3860441,"url":"https://alion.io/job/gruve-endpoint-security-operations-engineer-l2-microsoft-defender","title":"Endpoint Security Operations Engineer (L2) – Microsoft Defender","company":{"id":673112,"name":"Gruve","domain":"gruve.ai","url":"https://alion.io/company/gruve","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"A","score":87,"open_postings":7,"ghost_share":0,"stale_share":0.429,"repost_share":0.143,"time_to_fill_p50_days":35,"computed_at":"2026-11-09T06:03:00Z"}},"role":"Security","role_family":"Security","seniority":"middle","employment_type":null,"work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["India"],"countries":["IN"],"hiring_countries":["IN"],"hiring_countries_total":1,"salary":null,"salary_estimate":null,"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Incident Management","optional":false},{"name":"ITSM","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"PowerShell","optional":false},{"name":"ServiceNow","optional":false},{"name":"Windows","optional":false},{"name":"Microsoft Sentinel","optional":true}],"status":"live","first_seen_at":"2026-11-06T04:53:06Z","employer_posted_date":"2026-11-06","last_verified_at":"2026-11-09T09:24:50Z","board_verified":true,"closed_at":null,"days_open":3,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":3},"description":"About Gruve\nGruve is an innovative software services startup dedicated to transforming enterprises to AI powerhouses. We specialize in cybersecurity, customer experience, cloud infrastructure, and advanced technologies such as Large Language Models (LLMs). Our mission is to assist our customers in their business strategies utilizing their data to make more intelligent decisions. As a well-funded early-stage startup, Gruve offers a dynamic environment with strong customer and partner networks.\nPosition summary:\nWe are looking for a skilled L2 System Administrator to support Microsoft Defender security operations across enterprise endpoints and infrastructure. The role is responsible for investigating security alerts, analyzing endpoint threats, troubleshooting defender agen t and policy issues, supporting incident containment and remediation, and maintaining security compliance. The administrator will work closely with L1 operations, L3 Security SMEs, SOC, Endpoint, Identity and Infrastructure teams to ensure effective threat response and SLA compliance.\nKey Responsibilities:\nMicrosoft Defender Operations\nProvide L2 support for Microsoft Defender alerts, incidents and service requests.\nInvestigate endpoint detection alerts, malware detections, suspicious activities and security incidents using Microsoft Defender for Endpoint.\nAnalyze device timelines, alert evidence, process activity and investigation data to determine incident scope.\nTroubleshoot Defender sensor health, onboarding, connectivity, policy application and reporting issues.\nSupport approved threat containment and remediation activities, including device isolation and threat remediation.\nInvestigate antivirus detection, scan failures, signature updates and endpoint protection configuration issues.\nMonitor endpoint protection status and coordinate remediation of Defender health and compliance gaps.\n Security Incident Response & Remediation\nInvestigate escalated security alerts and determine appropriate response actions within approved procedures.\nSupport threat hunting, incident investigation and evidence collection as required.\nCoordinate with SOC and L3 Security teams for complex or high-severity incidents.\nExecute authorized remediation actions and validate endpoint security restoration.\nSupport vulnerability and exposure remediation activities using Microsoft security tools where applicable.\nMaintain incident timelines, investigation evidence and remediation records.\n Microsoft Security Platform & Compliance\nSupport Microsoft Defender portal operations, security policies and endpoint protection configurations within authorized scope.\nMonitor security dashboards, device risk status, protection coverage and sensor health.\nSupport onboarding and offboarding of endpoints into Defender in coordination with Endpoint teams.\nInvestigate security policy deviations and coordinate corrective actions with the relevant teams.\nSupport security reporting, audit evidence collection and compliance activities.\n Operations & Service Management\nResolve security operations incidents within defined SLAs and escalation procedures.\nFollow Incident, Problem, Change and Security Incident Management processes.\nParticipate in major incident response, service restoration and post-incident reviews.\nMaintain runbooks, investigation procedures, operational documentation and shift handover notes.\nCoordinate with L1/L3, SOC, Endpoint, Identity, Network and Infrastructure teams.\nEscalate complex threats, platform issues and incidents requiring advanced investigation to L3/SOC.\nEnsure effective APAC-EMEA-NLAM follow-the-sun handovers.\nRequired Skills & Qualifications:\n3-6 years of experience in enterprise security operations, Microsoft Defender administration, endpoint protection or security incident support.\nHands-on experience with Microsoft Defender for Endpoint and its security investigation capabilities.\nKnowledge of endpoint protection, malware detection, threat analysis and security incident handling.\nExperience investigating security alerts, device timelines, suspicious processes and endpoint activity.\nUnderstanding of Defender onboarding, sensor health, security policies and endpoint protection status.\nKnowledge of Windows operating systems, endpoint administration and basic PowerShell.\nUnderstanding of incident severity, containment, remediation and escalation procedures.\nFamiliarity with Microsoft Defender portal and security monitoring dashboards.\nExperience with ServiceNow or equivalent ITSM tools and incident management processes.\nStrong analytical, documentation and cross-team coordination skills.\nExperience in enterprise 24x7 production or security operations.\nPreferred Skills & Qualifications:\nMicrosoft SC-200 or equivalent security operations certification.\nExposure to Microsoft Defender XDR, Microsoft Sentinel and KQL.\nKnowledge of threat hunting, attack techniques and endpoint investigation.\nFamiliarity with Microsoft Defender for Identity and Defender for Office 365.\nExperience with vulnerability management, security compliance and incident reporting.\nPowerShell scripting and security operations automation experience.\nKey Competencies\nMicrosoft Defender for Endpoint | Security Alert Investigation | Threat Detection | Endpoint Protection | Incident Response | Threat Remediation | Device Isolation | Sensor Health | Security Compliance | PowerShell | ITSM | Escalation Management | Global 24x7 Operations\nWhy Gruve\nAt Gruve, we foster a culture of innovation, collaboration, and continuous learning. We are committed to building a diverse and inclusive workplace where everyone can thrive and contribute their best work. If you’re passionate about technology and eager to make an impact, we’d love to hear from you.\nGruve is an equal opportunity employer. We welcome applicants from all backgrounds and thank all who apply; however, only those selected for an interview will be contacted.","description_format":"text","description_chars":5935,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Continuous learning"],"hiring_locations":[{"name":"India","iso":"IN","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Endpoint Security","Vulnerability Management","Managed Security","AI Consulting & Integration"],"lifecycle":[{"event":"open","at":"2026-11-06T09:09:06Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":3,"expected_fill_days":35,"reasons":["conf:1","velocity","win:early"],"computed_at":"2026-11-09T06:03:00Z"},"pay":null,"html_url":"https://alion.io/job/gruve-endpoint-security-operations-engineer-l2-microsoft-defender","json_url":"https://alion.io/job/gruve-endpoint-security-operations-engineer-l2-microsoft-defender.json","meta":{"generated_at":"2026-11-09T11:31:54Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":13479,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-10T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":673112},"rest":"https://alion.io/mcp/rest/get_company?id=673112"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fgruve-endpoint-security-operations-engineer-l2-microsoft-defender"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fgruve-endpoint-security-operations-engineer-l2-microsoft-defender"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fgruve-endpoint-security-operations-engineer-l2-microsoft-defender"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/gruve-endpoint-security-operations-engineer-l2-microsoft-defender\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fgruve-endpoint-security-operations-engineer-l2-microsoft-defender"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3860441}},{"tool":"search_jobs","arguments":{"company":"gruve.ai","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3860441},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}