---
title: 'Endpoint Security Operations Engineer (L2) – Microsoft Defender at Gruve'
canonical: 'https://feeny.ai/job/endpoint-security-operations-engineer-l2-microsoft-defender-gruve-india-e2qkn15z5hnr'
type: 'job'
last_seen: '2026-11-11'
---

# Endpoint Security Operations Engineer (L2) – Microsoft Defender at Gruve

- **Company:** Gruve
- **Location:** India
- **Work type:** remote
- **Posted:** 2026-11-06
- **Last confirmed live:** 2026-11-11
- **Apply:** https://gruve.ai/careers/?gh_jid=5474019008

## Job description

## About Gruve

Gruve is an innovative software services startup dedicated to transforming enterprises to AI powerhouses. We specialize in cybersecurity, customer experience, cloud infrastructure, and advanced technologies such as Large Language Models (LLMs). Our mission is to assist our customers in their business strategies utilizing their data to make more intelligent decisions. As a well-funded early-stage startup, Gruve offers a dynamic environment with strong customer and partner networks.

Position summary:

We are looking for a skilled L2 System Administrator to support Microsoft Defender security operations across enterprise endpoints and infrastructure. The role is responsible for investigating security alerts, analyzing endpoint threats, troubleshooting defender agent and policy issues, supporting incident containment and remediation, and maintaining security compliance. The administrator will work closely with L1 operations, L3 Security SMEs, SOC, Endpoint, Identity and Infrastructure teams to ensure effective threat response and SLA compliance.

Key Responsibilities:

Microsoft Defender Operations

- Provide L2 support for Microsoft Defender alerts, incidents and service requests.
- Investigate endpoint detection alerts, malware detections, suspicious activities and security incidents using Microsoft Defender for Endpoint.
- Analyze device timelines, alert evidence, process activity and investigation data to determine incident scope.
- Troubleshoot Defender sensor health, onboarding, connectivity, policy application and reporting issues.
- Support approved threat containment and remediation activities, including device isolation and threat remediation.
- Investigate antivirus detection, scan failures, signature updates and endpoint protection configuration issues.
- Monitor endpoint protection status and coordinate remediation of Defender health and compliance gaps.

Security Incident Response & Remediation

- Investigate escalated security alerts and determine appropriate response actions within approved procedures.
- Support threat hunting, incident investigation and evidence collection as required.
- Coordinate with SOC and L3 Security teams for complex or high-severity incidents.
- Execute authorized remediation actions and validate endpoint security restoration.
- Support vulnerability and exposure remediation activities using Microsoft security tools where applicable.
- Maintain incident timelines, investigation evidence and remediation records.

Microsoft Security Platform & Compliance

- Support Microsoft Defender portal operations, security policies and endpoint protection configurations within authorized scope.
- Monitor security dashboards, device risk status, protection coverage and sensor health.
- Support onboarding and offboarding of endpoints into Defender in coordination with Endpoint teams.
- Investigate security policy deviations and coordinate corrective actions with the relevant teams.
- Support security reporting, audit evidence collection and compliance activities.

Operations & Service Management

- Resolve security operations incidents within defined SLAs and escalation procedures.
- Follow Incident, Problem, Change and Security Incident Management processes.
- Participate in major incident response, service restoration and post-incident reviews.
- Maintain runbooks, investigation procedures, operational documentation and shift handover notes.
- Coordinate with L1/L3, SOC, Endpoint, Identity, Network and Infrastructure teams.
- Escalate complex threats, platform issues and incidents requiring advanced investigation to L3/SOC.
- Ensure effective APAC–EMEA–NLAM follow-the-sun handovers.

Required Skills & Qualifications:

- 3–6 years of experience in enterprise security operations, Microsoft Defender administration, endpoint protection or security incident support.
- Hands-on experience with Microsoft Defender for Endpoint and its security investigation capabilities.
- Knowledge of endpoint protection, malware detection, threat analysis and security incident handling.
- Experience investigating security alerts, device timelines, suspicious processes and endpoint activity.
- Understanding of Defender onboarding, sensor health, security policies and endpoint protection status.
- Knowledge of Windows operating systems, endpoint administration and basic PowerShell.
- Understanding of incident severity, containment, remediation and escalation procedures.
- Familiarity with Microsoft Defender portal and security monitoring dashboards.
- Experience with ServiceNow or equivalent ITSM tools and incident management processes.
- Strong analytical, documentation and cross-team coordination skills.
- Experience in enterprise 24x7 production or security operations.

Preferred Skills & Qualifications:

- Microsoft SC-200 or equivalent security operations certification.
- Exposure to Microsoft Defender XDR, Microsoft Sentinel and KQL.
- Knowledge of threat hunting, attack techniques and endpoint investigation.
- Familiarity with Microsoft Defender for Identity and Defender for Office 365.
- Experience with vulnerability management, security compliance and incident reporting.
- PowerShell scripting and security operations automation experience.

## Key Competencies

Microsoft Defender for Endpoint | Security Alert Investigation | Threat Detection | Endpoint Protection | Incident Response | Threat Remediation | Device Isolation | Sensor Health | Security Compliance | PowerShell | ITSM | Escalation Management | Global 24x7 Operations

## Why Gruve

At Gruve, we foster a culture of innovation, collaboration, and continuous learning. We are committed to building a diverse and inclusive workplace where everyone can thrive and contribute their best work. If you’re passionate about technology and eager to make an impact, we’d love to hear from you.

Gruve is an equal opportunity employer. We welcome applicants from all backgrounds and thank all who apply; however, only those selected for an interview will be contacted.

## About Gruve

## Company Overview
- **One-liner**: Gruve provides AI-native cybersecurity, infrastructure, and data services that help enterprises deploy and secure AI at scale.
- **Entity Type**: Private (Series A, Seed stage)
- **Headquarters**: Redwood City, California, United States
- **Founded**: 2024
- **Founders**: Tarun Raisoni (CEO, Co-Founder)

## Core Business
- **Industry**: IT Services and IT Consulting; AI Security & Infrastructure
- **Target Customers**: Large enterprises (B2B), including those in regulated industries requiring private AI deployment and advanced security operations.
- **Mission / Purpose**: Enable scalable, secure, and measurable AI execution in production by delivering an AI-native approach to enterprise services.

## Products & Services
- **PulseAI**: A private AI infrastructure platform that enables enterprises to deploy generative AI on-premises, in the cloud, or in hybrid environments – production-ready in under two weeks. (SaaS/infrastructure)
- **AI SOC**: An AI-driven Security Operations Center that combines AI detection, automated investigation, and intelligent response to improve security team efficiency and reduce risk. (Managed service/SaaS)
- **Digital Forensics & Incident Response**: Structured methodologies for preserving evidence, investigating incidents, and accelerating recovery. (Service)
- **Enterprise AI Transformation Services**: Consulting and implementation services including data science, Kubernetes SRE, forward deployment engineering, and AI solution architecture. (Professional services)

## Market Standing
- **Valuation**: Not disclosed
- **Total Funding**: USD $57.5 million (across Seed and Series A rounds)
- **Key Investors**: Mayfield Fund (lead in Series A), Xora Innovation (lead in prior round)
- **Notable Acquisitions**: SecurView (July 2024), NetServ (September 2024), Lumos (October 2024)
- **Growth Signals**: 120.3% YoY employee growth (from ~134 to 413 employees); operations across 9 countries; featured in Cybersecurity Insiders on AI agent governance.

## Competitive Advantages
- **AI-Native Architecture**: Unlike legacy stacks built for static software, Gruve designs for dynamic AI workloads (probabilistic decisions, context retrieval, autonomous actions).
- **Speed to Scale**: Claims 500MW+ of distributed edge AI inference capacity and a 30% cost advantage over alternatives.
- **Integrated Security & AI**: Combines private AI infrastructure (PulseAI) with an AI-powered SOC, covering the entire lifecycle from deployment to defense.
- **Talent & Expertise**: Team draws from top firms (Cisco, IBM, Infosys) and includes deep Kubernetes, data science, and cybersecurity specialists.

## Strategic Focus
- **Private AI Deployment**: Helping enterprises keep AI workloads on their own infrastructure to maintain data ownership, governance, and security.
- **AI Security Governance**: Developing solutions to govern AI agents as a new attack surface, as highlighted in their recent thought leadership.
- **Global Expansion**: Operating in 9 countries (US, India, South Korea, UAE, Singapore, Japan, Saudi Arabia, Germany, Canada) with plans to scale further.
- **Partner Ecosystem**: Working closely with hyperscalers (noted VP of Hyperscaler Solutions) and achieving Red Hat advanced tier partner status.

## Why Work Here
- **High Growth Environment**: Headcount more than doubled in the past year, offering rapid career progression and the chance to shape a young company.
- **Culture of Trust**: Core values include giving trust from day one, constructive feedback, and a championship mindset.  
- **Global & Remote-Friendly**: Offices in 4 countries (US, India, Singapore, UAE) and remote roles posted; a distributed team with cultural diversity.
- **Learning & Impact**: Mentorship programs, opportunities to lead innovative projects in AI and security, and the ability to work on cutting-edge infrastructure.
- **Notable Perks**: Focus on career development, knowledge sharing, and a "people-first" approach.

## Sources
1. [gruve.ai – Company homepage](https://gruve.ai/)
2. [gruve.ai – About Us](https://gruve.ai/about-us/)
3. [gruve.ai – Life at Gruve](https://gruve.ai/life-at-gruve/)
4. [linkedin.com/company/gruveai – LinkedIn Company Page](https://www.linkedin.com/company/gruveai)
5. [job-boards.greenhouse.io/gruve – Careers Page](https://job-boards.greenhouse.io/gruve)

## Other roles at Gruve

- [Identity & Access Support Analyst (L1) – Active Directory, LDAP & ADFS](https://feeny.ai/job/identity-access-support-analyst-l1-active-directory-ldap-adfs-gruve-india-0ye2c1xj0c12) — India
- [Security Operations Analyst (L1) – MS- Defender](https://feeny.ai/job/security-operations-analyst-l1-ms-defender-gruve-india-ynsbs12h8w8v) — India
- [Endpoint Operations Analyst (L1) – Intune & SCCM](https://feeny.ai/job/endpoint-operations-analyst-l1-intune-sccm-gruve-india-7t5jxvke67hz) — India
- [L1 System Administrator | Windows, VMware & Cloud Operations](https://feeny.ai/job/l1-system-administrator-windows-vmware-cloud-operations-gruve-india-2j0emswr2q06) — India
- [Identity & Access Operations Engineer (L2) – Active Directory, LDAP & ADFS](https://feeny.ai/job/identity-access-operations-engineer-l2-active-directory-ldap-adfs-gruve-india-tg3gbwqgensx) — India
- [Endpoint Management Engineer (L2) – Intune & SCCM/MECM](https://feeny.ai/job/endpoint-management-engineer-l2-intune-sccm-mecm-gruve-india-ystzggvts8d8) — India
- [Backup & Storage Engineer (L2) – Commvault, NetBackup & Veeam](https://feeny.ai/job/backup-storage-engineer-l2-commvault-netbackup-veeam-gruve-india-4mp4ezra5v14) — India
- [Vulnerability Management & Security Assessment Engineer (L2) – Qualys VMDR](https://feeny.ai/job/vulnerability-management-security-assessment-engineer-l2-qualys-vmdr-gruve-india-ex58qf4xtn7f) — India
- [L1 PAM Operations Engineer | Privileged Access Management (PAM) Operations](https://feeny.ai/job/l1-pam-operations-engineer-privileged-access-management-pam-operations-gruve-6bzxs5103x6p) — India
- [Director of Human Resources](https://feeny.ai/job/director-of-human-resources-gruve-redwood-city-m1azzpdexmrc) — Redwood City, CA