{"id":3860439,"url":"https://alion.io/job/gruve-security-operations-analyst-l1-ms-defender","title":"Security Operations Analyst (L1) – MS- Defender","company":{"id":673112,"name":"Gruve","domain":"gruve.ai","url":"https://alion.io/company/gruve","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"A","score":87,"open_postings":7,"ghost_share":0,"stale_share":0.429,"repost_share":0.143,"time_to_fill_p50_days":35,"computed_at":"2026-11-10T06:52:35Z"}},"role":"Security","role_family":"Security","seniority":"junior","employment_type":null,"work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["India"],"countries":["IN"],"hiring_countries":["IN"],"hiring_countries_total":1,"salary":null,"salary_estimate":null,"experience_years_min":1,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Incident Management","optional":false},{"name":"ITSM","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"ServiceNow","optional":false},{"name":"Windows","optional":false},{"name":"ITIL","optional":true},{"name":"Microsoft Sentinel","optional":true},{"name":"PowerShell","optional":true}],"status":"live","first_seen_at":"2026-11-06T05:19:14Z","employer_posted_date":"2026-11-06","last_verified_at":"2026-11-10T17:04:08Z","board_verified":true,"closed_at":null,"days_open":4,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":4},"description":"About Gruve\nGruve is an innovative software services startup dedicated to transforming enterprises to AI powerhouses. We specialize in cybersecurity, customer experience, cloud infrastructure, and advanced technologies such as Large Language Models (LLMs). Our mission is to assist our customers in their business strategies utilizing their data to make more intelligent decisions. As a well-funded early-stage startup, Gruve offers a dynamic environment with strong customer and partner networks.\nPosition summary:\nWe are looking for a proactive L1 System Administrator to support day-to-day Microsoft Defender operations. The role is responsible for monitoring security alerts, performing initial triage, validating endpoint protection status, logging incidents and escalating potential threats to L2/L3 teams. The administrator will follow approved security procedures and runbooks to support timely incident response and continuous security monitoring.\nKey Responsibilities:\nMicrosoft Defender Monitoring\nMonitor Microsoft Defender portals, security dashboards, alerts and incident queues.\nPerform initial triage of malware detections, suspicious activities and endpoint security alerts.\nReview alert details, device information, severity and timestamps to assess potential impact.\nPerform basic checks on Defender sensor health, endpoint onboarding and protection status.\nIdentify endpoints with failed scans, outdated security intelligence or protection-related issues.\nEscalate suspicious activities and high-severity alerts according to established procedures.\n Security Incident & Endpoint Support\nCreate, categorize, prioritize and update security incident tickets in ServiceNow or equivalent ITSM tools.\nCollect relevant alert evidence, device details, timestamps and investigation information.\nPerform approved first-level checks using documented security runbooks.\nTrack incidents and coordinate with L2/SOC teams for investigation and remediation.\nValidate remediation status and endpoint protection recovery as directed.\nAvoid unauthorized containment or remediation actions and follow established security escalation procedures.\n Operations & Service Management\nFollow Security Incident, Incident, Change and Request Management processes.\nEnsure timely alert acknowledgement, escalation and SLA compliance.\nMaintain accurate incident records, operational checklists and shift handover documentation.\nCoordinate with L2/L3, SOC, Endpoint, Identity and Infrastructure teams.\nSupport routine security reporting, alert tracking and operational reviews.\nIdentify recurring alerts and report monitoring or documentation gaps to L2.\nEnsure effective APAC-EMEA-NLAM shift handovers and uninterrupted 24x7 monitoring.\nRequired Skills & Qualifications:\n1-3 years of experience in IT operations, security monitoring, endpoint support or security incident management. \nBasic understanding of endpoint security, antivirus, malware detection and security alerts.\nFamiliarity with Microsoft Defender for Endpoint or equivalent endpoint protection tools.\nBasic knowledge of Windows operating systems, processes and endpoint health.\nAbility to review alerts, capture evidence and follow documented investigation procedures.\nUnderstanding of incident severity, escalation matrices and SLA requirements.\nFamiliarity with ServiceNow or equivalent ITSM platforms.\nGood communication, documentation and shift handover skills.\nStrong attention to detail and adherence to security procedures.\nWillingness to work in rotational shifts in a 24x7 security operations environment.\nPreferred Skills & Qualifications:\nMicrosoft SC-900 or equivalent security fundamentals certification.\nBasic knowledge of Microsoft Defender XDR and Microsoft Sentinel.\nFamiliarity with malware, phishing, endpoint threats and common attack techniques.\nBasic PowerShell and Windows troubleshooting knowledge.\nExposure toKQL, security dashboards and incident reporting.\nUnderstanding of ITIL and security incident management processes.\nSecurity Monitoring | Microsoft Defender | Alert Triage | Endpoint Protection | Basic Threat Analysis.\nIncident Logging | Evidence Collection | Runbook Execution | SLA Compliance.\nEscalation Management | Shift Handover | Global 24x7 Operations\nWhy Gruve\nAt Gruve, we foster a culture of innovation, collaboration, and continuous learning. We are committed to building a diverse and inclusive workplace where everyone can thrive and contribute their best work. If you’re passionate about technology and eager to make an impact, we’d love to hear from you.\nGruve is an equal opportunity employer. We welcome applicants from all backgrounds and thank all who apply; however, only those selected for an interview will be contacted.","description_format":"text","description_chars":4730,"description_truncated":false,"requirements":{"experience_years_min":1,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Continuous learning"],"hiring_locations":[{"name":"India","iso":"IN","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Managed Security","Managed IT Services (MSP)","Cybersecurity AI","AI Consulting & Integration"],"lifecycle":[{"event":"open","at":"2026-11-06T09:09:06Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":4,"expected_fill_days":35,"reasons":["conf:0","velocity","win:early","comp:junior"],"computed_at":"2026-11-10T06:52:35Z"},"pay":null,"html_url":"https://alion.io/job/gruve-security-operations-analyst-l1-ms-defender","json_url":"https://alion.io/job/gruve-security-operations-analyst-l1-ms-defender.json","meta":{"generated_at":"2026-11-10T17:26:14Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":6119,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-11T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":673112},"rest":"https://alion.io/mcp/rest/get_company?id=673112"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fgruve-security-operations-analyst-l1-ms-defender"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fgruve-security-operations-analyst-l1-ms-defender"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fgruve-security-operations-analyst-l1-ms-defender"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/gruve-security-operations-analyst-l1-ms-defender\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fgruve-security-operations-analyst-l1-ms-defender"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3860439}},{"tool":"search_jobs","arguments":{"company":"gruve.ai","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3860439},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}