L1 Soc Analyst

Required

• 1+ year in IT support, service desk, systems administration, or a security operations role. Strong candidates with certifications and demonstrable lab work will be considered without commercial security experience.
• Working knowledge of Microsoft 365 and a cloud-first or hybrid environment.
• Networking and mail flow fundamentals: TCP/IP, DNS, SMTP, MX records, VPN, firewall concepts.
• Windows and macOS fundamentals - processes, logons, and where the logs live.
• Understanding of common attack techniques: phishing, credential theft, MFA fatigue, token theft, malware delivery.
• Professional written and verbal English. Case notes and escalations are written in English.
• The discipline to follow a runbook exactly, and the judgement to escalate early rather than improvise.

Preffered

• Hands-on exposure to Microsoft Sentinel, Defender XDR, Defender for Office 365, or Entra ID.
• Ability to read and adapt a KQL query, or basic PowerShell.
• CompTIA Security+ or Microsoft SC-900.
• Familiarity with MITRE ATT&CK.
• Awareness of NIST SP 800-171, CMMC 2.0, or GDPR.

What KVG Offers

• Funded Microsoft certification path - SC-200 is the target credential for this role, with the exam paid by KVG.
• A defined progression route from L1 triage to L2 analysis.
• A single-vendor Microsoft security stack: Sentinel, Defender XDR, Entra ID, Intune, Purview - depth rather than tool sprawl.
• Direct mentoring from the Cloud Security Engineer rather than an anonymous alert queue.
• European business-hours coverage with rotational extended-hours support for other regions. This is not a 24/7 shift rotation.
• Collaborative Spirit | Results Above All | Innovation as a Habit | Creative Freedom | Financial Prudence | Eternal Learner | Daring Adventures | Open Feedback | Integrity in Action | Embrace Change | Accountability