---
title: 'Security Operations Analyst (L1) – MS- Defender at Gruve'
canonical: 'https://feeny.ai/job/security-operations-analyst-l1-ms-defender-gruve-india-ynsbs12h8w8v'
type: 'job'
last_seen: '2026-11-11'
---

# Security Operations Analyst (L1) – MS- Defender at Gruve

- **Company:** Gruve
- **Location:** India
- **Work type:** remote
- **Posted:** 2026-11-06
- **Last confirmed live:** 2026-11-11
- **Apply:** https://gruve.ai/careers/?gh_jid=5474001008

## Job description

## About Gruve

Gruve is an innovative software services startup dedicated to transforming enterprises to AI powerhouses. We specialize in cybersecurity, customer experience, cloud infrastructure, and advanced technologies such as Large Language Models (LLMs). Our mission is to assist our customers in their business strategies utilizing their data to make more intelligent decisions. As a well-funded early-stage startup, Gruve offers a dynamic environment with strong customer and partner networks.

Position summary:

We are looking for a proactive L1 System Administrator to support day-to-day Microsoft Defender operations. The role is responsible for monitoring security alerts, performing initial triage, validating endpoint protection status, logging incidents and escalating potential threats to L2/L3 teams. The administrator will follow approved security procedures and runbooks to support timely incident response and continuous security monitoring.

Key Responsibilities:

Microsoft Defender Monitoring

- Monitor Microsoft Defender portals, security dashboards, alerts and incident queues.
- Perform initial triage of malware detections, suspicious activities and endpoint security alerts.
- Review alert details, device information, severity and timestamps to assess potential impact.
- Perform basic checks on Defender sensor health, endpoint onboarding and protection status.
- Identify endpoints with failed scans, outdated security intelligence or protection-related issues.
- Escalate suspicious activities and high-severity alerts according to established procedures.

Security Incident & Endpoint Support

- Create, categorize, prioritize and update security incident tickets in ServiceNow or equivalent ITSM tools.
- Collect relevant alert evidence, device details, timestamps and investigation information.
- Perform approved first-level checks using documented security runbooks.
- Track incidents and coordinate with L2/SOC teams for investigation and remediation.
- Validate remediation status and endpoint protection recovery as directed.
- Avoid unauthorized containment or remediation actions and follow established security escalation procedures.

Operations & Service Management

- Follow Security Incident, Incident, Change and Request Management processes.
- Ensure timely alert acknowledgement, escalation and SLA compliance.
- Maintain accurate incident records, operational checklists and shift handover documentation.
- Coordinate with L2/L3, SOC, Endpoint, Identity and Infrastructure teams.
- Support routine security reporting, alert tracking and operational reviews.
- Identify recurring alerts and report monitoring or documentation gaps to L2.
- Ensure effective APAC–EMEA–NLAM shift handovers and uninterrupted 24x7 monitoring.

Required Skills & Qualifications:

- 1–3 years of experience in IT operations, security monitoring, endpoint support or security incident management.
- Basic understanding of endpoint security, antivirus, malware detection and security alerts.
- Familiarity with Microsoft Defender for Endpoint or equivalent endpoint protection tools.
- Basic knowledge of Windows operating systems, processes and endpoint health.
- Ability to review alerts, capture evidence and follow documented investigation procedures.
- Understanding of incident severity, escalation matrices and SLA requirements.
- Familiarity with ServiceNow or equivalent ITSM platforms.
- Good communication, documentation and shift handover skills.
- Strong attention to detail and adherence to security procedures.
- Willingness to work in rotational shifts in a 24x7 security operations environment.

Preferred Skills & Qualifications:

- Microsoft SC-900 or equivalent security fundamentals certification.
- Basic knowledge of Microsoft Defender XDR and Microsoft Sentinel.
- Familiarity with malware, phishing, endpoint threats and common attack techniques.
- Basic PowerShell and Windows troubleshooting knowledge.
- Exposure to KQL, security dashboards and incident reporting.
- Understanding of ITIL and security incident management processes.
- Security Monitoring | Microsoft Defender | Alert Triage | Endpoint Protection | Basic Threat Analysis.
- Incident Logging | Evidence Collection | Runbook Execution | SLA Compliance.
- Escalation Management | Shift Handover | Global 24x7 Operations

## Why Gruve

At Gruve, we foster a culture of innovation, collaboration, and continuous learning. We are committed to building a diverse and inclusive workplace where everyone can thrive and contribute their best work. If you’re passionate about technology and eager to make an impact, we’d love to hear from you.

Gruve is an equal opportunity employer. We welcome applicants from all backgrounds and thank all who apply; however, only those selected for an interview will be contacted.

## About Gruve

## Company Overview
- **One-liner**: Gruve provides AI-native cybersecurity, infrastructure, and data services that help enterprises deploy and secure AI at scale.
- **Entity Type**: Private (Series A, Seed stage)
- **Headquarters**: Redwood City, California, United States
- **Founded**: 2024
- **Founders**: Tarun Raisoni (CEO, Co-Founder)

## Core Business
- **Industry**: IT Services and IT Consulting; AI Security & Infrastructure
- **Target Customers**: Large enterprises (B2B), including those in regulated industries requiring private AI deployment and advanced security operations.
- **Mission / Purpose**: Enable scalable, secure, and measurable AI execution in production by delivering an AI-native approach to enterprise services.

## Products & Services
- **PulseAI**: A private AI infrastructure platform that enables enterprises to deploy generative AI on-premises, in the cloud, or in hybrid environments – production-ready in under two weeks. (SaaS/infrastructure)
- **AI SOC**: An AI-driven Security Operations Center that combines AI detection, automated investigation, and intelligent response to improve security team efficiency and reduce risk. (Managed service/SaaS)
- **Digital Forensics & Incident Response**: Structured methodologies for preserving evidence, investigating incidents, and accelerating recovery. (Service)
- **Enterprise AI Transformation Services**: Consulting and implementation services including data science, Kubernetes SRE, forward deployment engineering, and AI solution architecture. (Professional services)

## Market Standing
- **Valuation**: Not disclosed
- **Total Funding**: USD $57.5 million (across Seed and Series A rounds)
- **Key Investors**: Mayfield Fund (lead in Series A), Xora Innovation (lead in prior round)
- **Notable Acquisitions**: SecurView (July 2024), NetServ (September 2024), Lumos (October 2024)
- **Growth Signals**: 120.3% YoY employee growth (from ~134 to 413 employees); operations across 9 countries; featured in Cybersecurity Insiders on AI agent governance.

## Competitive Advantages
- **AI-Native Architecture**: Unlike legacy stacks built for static software, Gruve designs for dynamic AI workloads (probabilistic decisions, context retrieval, autonomous actions).
- **Speed to Scale**: Claims 500MW+ of distributed edge AI inference capacity and a 30% cost advantage over alternatives.
- **Integrated Security & AI**: Combines private AI infrastructure (PulseAI) with an AI-powered SOC, covering the entire lifecycle from deployment to defense.
- **Talent & Expertise**: Team draws from top firms (Cisco, IBM, Infosys) and includes deep Kubernetes, data science, and cybersecurity specialists.

## Strategic Focus
- **Private AI Deployment**: Helping enterprises keep AI workloads on their own infrastructure to maintain data ownership, governance, and security.
- **AI Security Governance**: Developing solutions to govern AI agents as a new attack surface, as highlighted in their recent thought leadership.
- **Global Expansion**: Operating in 9 countries (US, India, South Korea, UAE, Singapore, Japan, Saudi Arabia, Germany, Canada) with plans to scale further.
- **Partner Ecosystem**: Working closely with hyperscalers (noted VP of Hyperscaler Solutions) and achieving Red Hat advanced tier partner status.

## Why Work Here
- **High Growth Environment**: Headcount more than doubled in the past year, offering rapid career progression and the chance to shape a young company.
- **Culture of Trust**: Core values include giving trust from day one, constructive feedback, and a championship mindset.  
- **Global & Remote-Friendly**: Offices in 4 countries (US, India, Singapore, UAE) and remote roles posted; a distributed team with cultural diversity.
- **Learning & Impact**: Mentorship programs, opportunities to lead innovative projects in AI and security, and the ability to work on cutting-edge infrastructure.
- **Notable Perks**: Focus on career development, knowledge sharing, and a "people-first" approach.

## Sources
1. [gruve.ai – Company homepage](https://gruve.ai/)
2. [gruve.ai – About Us](https://gruve.ai/about-us/)
3. [gruve.ai – Life at Gruve](https://gruve.ai/life-at-gruve/)
4. [linkedin.com/company/gruveai – LinkedIn Company Page](https://www.linkedin.com/company/gruveai)
5. [job-boards.greenhouse.io/gruve – Careers Page](https://job-boards.greenhouse.io/gruve)

## Other roles at Gruve

- [Identity & Access Support Analyst (L1) – Active Directory, LDAP & ADFS](https://feeny.ai/job/identity-access-support-analyst-l1-active-directory-ldap-adfs-gruve-india-0ye2c1xj0c12) — India
- [Endpoint Operations Analyst (L1) – Intune & SCCM](https://feeny.ai/job/endpoint-operations-analyst-l1-intune-sccm-gruve-india-7t5jxvke67hz) — India
- [L1 System Administrator | Windows, VMware & Cloud Operations](https://feeny.ai/job/l1-system-administrator-windows-vmware-cloud-operations-gruve-india-2j0emswr2q06) — India
- [Endpoint Security Operations Engineer (L2) – Microsoft Defender](https://feeny.ai/job/endpoint-security-operations-engineer-l2-microsoft-defender-gruve-india-e2qkn15z5hnr) — India
- [Identity & Access Operations Engineer (L2) – Active Directory, LDAP & ADFS](https://feeny.ai/job/identity-access-operations-engineer-l2-active-directory-ldap-adfs-gruve-india-tg3gbwqgensx) — India
- [Endpoint Management Engineer (L2) – Intune & SCCM/MECM](https://feeny.ai/job/endpoint-management-engineer-l2-intune-sccm-mecm-gruve-india-ystzggvts8d8) — India
- [Backup & Storage Engineer (L2) – Commvault, NetBackup & Veeam](https://feeny.ai/job/backup-storage-engineer-l2-commvault-netbackup-veeam-gruve-india-4mp4ezra5v14) — India
- [Vulnerability Management & Security Assessment Engineer (L2) – Qualys VMDR](https://feeny.ai/job/vulnerability-management-security-assessment-engineer-l2-qualys-vmdr-gruve-india-ex58qf4xtn7f) — India
- [L1 PAM Operations Engineer | Privileged Access Management (PAM) Operations](https://feeny.ai/job/l1-pam-operations-engineer-privileged-access-management-pam-operations-gruve-6bzxs5103x6p) — India
- [Director of Human Resources](https://feeny.ai/job/director-of-human-resources-gruve-redwood-city-m1azzpdexmrc) — Redwood City, CA