Security Operations Analyst (L1) – MS- Defender

About the role

We are looking for a proactive L1 System Administrator to support day-to-day Microsoft Defender operations . The role is responsible for monitoring security alerts, performing initial triage, validating endpoint protection status, logging incidents and escalating potential threats to L2/L3 teams. The administrator will follow approved security procedures and runbooks to support timely incident response and continuous security monitoring.

What you'll do

• Monitor Microsoft Defender portals, security dashboards, alerts and incident queues
• Perform initial triage of malware detections, suspicious activities and endpoint security alerts
• Review alert details, device information, severity and timestamps to assess potential impact
• Perform basic checks on Defender sensor health, endpoint onboarding and protection status
• Identify endpoints with failed scans, outdated security intelligence or protection-related issues

What you need

• 1–3 yrs of experience
• Compliance
• ServiceNow
• ITIL
• PowerShell
• Incident response
• Any graduate