[Hiring] Security Operations Analyst @Gruve

Role Description

We are looking for a proactive L1 System Administrator to support day-to-day Microsoft Defender operations. The role is responsible for:

• Monitoring security alerts
• Performing initial triage
• Validating endpoint protection status
• Logging incidents
• Escalating potential threats to L2/L3 teams

The administrator will follow approved security procedures and runbooks to support timely incident response and continuous security monitoring.

Qualifications

• 1–3 years of experience in IT operations, security monitoring, endpoint support or security incident management
• Basic understanding of endpoint security, antivirus, malware detection and security alerts
• Familiarity with Microsoft Defender for Endpoint or equivalent endpoint protection tools
• Basic knowledge of Windows operating systems, processes and endpoint health
• Ability to review alerts, capture evidence and follow documented investigation procedures
• Understanding of incident severity, escalation matrices and SLA requirements
• Familiarity with ServiceNow or equivalent ITSM platforms
• Good communication, documentation and shift handover skills
• Strong attention to detail and adherence to security procedures
• Willingness to work in rotational shifts in a 24x7 security operations environment

Requirements

• Monitor Microsoft Defender portals, security dashboards, alerts and incident queues
• Perform initial triage of malware detections, suspicious activities and endpoint security alerts
• Review alert details, device information, severity and timestamps to assess potential impact
• Perform basic checks on Defender sensor health, endpoint onboarding and protection status
• Identify endpoints with failed scans, outdated security intelligence or protection-related issues
• Escalate suspicious activities and high-severity alerts according to established procedures
• Create, categorize, prioritize and update security incident tickets in ServiceNow or equivalent ITSM tools
• Collect relevant alert evidence, device details, timestamps and investigation information
• Perform approved first-level checks using documented security runbooks
• Track incidents and coordinate with L2/SOC teams for investigation and remediation
• Validate remediation status and endpoint protection recovery as directed
• Avoid unauthorized containment or remediation actions and follow established security escalation procedures
• Follow Security Incident, Incident, Change and Request Management processes
• Ensure timely alert acknowledgement, escalation and SLA compliance
• Maintain accurate incident records, operational checklists and shift handover documentation
• Coordinate with L2/L3, SOC, Endpoint, Identity and Infrastructure teams
• Support routine security reporting, alert tracking and operational reviews
• Identify recurring alerts and report monitoring or documentation gaps to L2
• Ensure effective APAC–EMEA–NLAM shift handovers and uninterrupted 24x7 monitoring

Benefits

• Culture of innovation, collaboration, and continuous learning
• Diverse and inclusive workplace

Company Description

Gruve is an innovative software services startup dedicated to transforming enterprises to AI powerhouses. We specialize in cybersecurity, customer experience, cloud infrastructure, and advanced technologies such as Large Language Models (LLMs). Our mission is to assist our customers in their business strategies utilizing their data to make more intelligent decisions. As a well-funded early-stage startup, Gruve offers a dynamic environment with strong customer and partner networks.