Job Description: SOC Team Lead (L2)

Job Title: SOC Team Lead (L2)
Work Setup: Hybrid
Work Location: Cubao, Philippines
Work Shift: Shifting Schedule
Salary Budget: Confidential (To be discussed during the job offer)
Experience Required: 3–5+ Years
Employment Eligibility: Applicants must currently be based in the Philippines and have the legal right to live and work in the country.

Job Overview

We are looking for an experienced SOC Team Lead (L2) to join a Cybersecurity Operations team. The successful candidate will lead Level 2 security incident investigations, coordinate incident response activities, and strengthen enterprise cyber defense operations.

This role requires strong hands-on expertise in Security Operations Center (SOC) processes, SIEM platforms, threat detection, incident response, and threat hunting. The ideal candidate will also have experience mentoring SOC analysts and collaborating with cross-functional security teams to improve incident handling and operational effectiveness.

Key Responsibilities

• Lead the investigation, analysis, and resolution of complex security incidents escalated by Level 1 (L1) SOC analysts.

• Perform incident triage, threat validation, root cause analysis, and security event investigations across enterprise environments.

• Act as a key responder during high-severity security incidents, coordinating with CSIRT, engineering teams, and relevant stakeholders.

• Conduct threat hunting activities using Indicators of Compromise (IoCs), threat intelligence, and security monitoring tools.

• Analyze security logs, network traffic, alerts, and events to identify potential threats and vulnerabilities.

• Mentor, coach, and guide SOC analysts through quality reviews, knowledge sharing, and incident-handling best practices.

• Collaborate with detection engineering teams to enhance detection use cases, improve alert quality, and optimize SOC processes.

• Maintain accurate incident documentation, investigation reports, response playbooks, and operational procedures.

• Identify opportunities to improve security monitoring, incident response processes, and overall cyber defense capabilities.

Required Qualifications

• At least 3–5+ years of experience in a Security Operations Center (SOC), Incident Response, or Cyber Defense environment.

• Previous experience leading, mentoring, supervising, or guiding SOC analysts is highly preferred.

• Strong hands-on experience investigating security incidents using SIEM and security monitoring platforms.

• Solid knowledge of network security, threat detection, malware analysis, incident response, and threat hunting.

• Experience analyzing security logs, network traffic, and security events across enterprise environments.

• Ability to handle high-priority security incidents and coordinate response activities across multiple teams.

• Strong analytical, troubleshooting, communication, and problem-solving skills.

• Willingness to work in a hybrid setup in Cubao and accommodate shifting schedules.

Preferred Qualifications

• Hands-on experience with CrowdStrike Falcon is highly preferred.

• Experience with SIEM platforms such as:

  • Splunk

  • Microsoft Sentinel

  • IBM QRadar

  • Google SecOps

  • Other comparable SIEM solutions

• Scripting knowledge in Python or PowerShell for automation and security investigations.

• Relevant certifications such as Security+, CEH, GCIH, GCIA, or equivalent.

• Exposure to cloud security monitoring across AWS, Microsoft Azure, or Google Cloud Platform (GCP).

Employment Details

• Work Arrangement: Hybrid

• Office Location: Cubao, Philippines

• Work Schedule: Shifting

• Salary: Confidential; to be discussed during the job offer.

• Experience: 3–5+ years

• Eligibility: Must currently be located in the Philippines and possess the legal right to live and work in the country.

Recruitment Process

1. Initial screening with the CV Reviewer.

2. Candidate endorsement for validation and further CV screening through Workday.

3. Review of the HRI Toolkit, FCV, and updated CV.

4. Client review.

Pre-Screening Questions

1. How many years of experience do you have in a SOC, Incident Response, or Cyber Defense environment?

2. Have you led, mentored, supervised, or guided SOC analysts? Please briefly describe your leadership experience.

3. What is your level of hands-on experience with SIEM platforms such as Splunk, Sentinel, QRadar, or Google SecOps?

4. Do you have experience with CrowdStrike Falcon?

5. What is your last drawn salary?

6. What is your expected salary?

7. Are you currently based in the Philippines and legally authorized to live and work in the country?

8. Are you willing to work in a hybrid setup in Cubao with a shifting schedule?

9. What is your current notice period?

Important Recruitment Notes

• Do not mention the client’s name in job postings or candidate communications.

• Submit only the candidate’s latest CV in PDF format.

• Include screening notes clearly highlighting relevant SOC experience, L2 incident response capabilities, SIEM expertise, CrowdStrike exposure, leadership experience, certifications, and work authorization.

• Prioritize candidates with strong hands-on L2 incident investigation and SOC leadership experience.