L1 SOC ANALYST

KVG is looking for an L1 SOC Analyst to become the first line of security monitoring for a Microsoft-based environment spanning Moldova, Romania, Ukraine, Germany, Spain, the Philippines, and the United States. You will own the daily triage of alerts in Microsoft Sentinel and Microsoft Defender XDR, and the review of the Microsoft 365 email quarantine - deciding what is real, what is noise, and what needs to go up the chain.

This is a structured entry point into security operations. You will work to documented runbooks and a clear action mandate, alongside our Cloud Security Engineer, in an environment with genuine compliance weight behind it (NIST SP 800-171 and CMMC 2.0). We fund your certification path and expect you to grow into L2 analysis.

• Monitor and triage incidents in Microsoft Sentinel and Microsoft Defender XDR, working in order of severity.
• Decide whether an alert is a true positive, a false positive, or benign - and write down why.
• Review the Defender for Office 365 quarantine, handle user-reported phishing, and action release or block decisions.
• Analyse message headers, SPF/DKIM/DMARC results, URLs, and attachments to reach a defensible verdict.
• Run pre-built KQL queries in Advanced Hunting to work out who and what was affected.
• Apply runbook-defined containment: revoke sessions, block sign-in, isolate a device, purge a delivered message.
• Escalate anything beyond your mandate with a clear timeline, the evidence, and what you already did.
• Keep case records that hold up under audit, and hand over cleanly at the end of each shift.
• Flag noisy detections and recurring false positives so they can be tuned out.

Required

Preffered

What KVG Offers

Professional Competencies

Collaborative Spirit | Results Above All | Innovation as a Habit | Creative Freedom | Financial Prudence | Eternal Learner | Daring Adventures | Open Feedback | Integrity in Action | Embrace Change | Accountability