L1 security operations role monitoring Microsoft Defender alerts, dashboards and incident queues, performing initial triage of malware and endpoint alerts. The analyst logs incidents in ServiceNow, validates Defender sensor health, and escalates to L2/SOC teams. Work follows a 24x7 follow-the-sun model across APAC, EMEA and NLAM shifts.
About Gruve
Gruve is an innovative software services startup dedicated to transforming enterprises to AI powerhouses. We specialize in cybersecurity, customer experience, cloud infrastructure, and advanced technologies such as Large Language Models (LLMs). Our mission is to assist our customers in their business strategies utilizing their data to make more intelligent decisions. As a well-funded early-stage startup, Gruve offers a dynamic environment with strong customer and partner networks.
Position summary:
We are looking for a proactive L1 System Administrator to support day-to-day Microsoft Defender operations. The role is responsible for monitoring security alerts, performing initial triage, validating endpoint protection status, logging incidents and escalating potential threats to L2/L3 teams. The administrator will follow approved security procedures and runbooks to support timely incident response and continuous security monitoring.
Key Responsibilities:
Microsoft Defender Monitoring
Security Incident & Endpoint Support
Operations & Service Management
Required Skills & Qualifications:
Preferred Skills & Qualifications:
Why Gruve
At Gruve, we foster a culture of innovation, collaboration, and continuous learning. We are committed to building a diverse and inclusive workplace where everyone can thrive and contribute their best work. If you’re passionate about technology and eager to make an impact, we’d love to hear from you.
Gruve is an equal opportunity employer. We welcome applicants from all backgrounds and thank all who apply; however, only those selected for an interview will be contacted.