SOC L2 – Security Operations / Cyber Defense

Location: Manila – Hybrid in Cubao
Work Setup: Hybrid
Work Shift: Shifting
Employment Type: Full-Time

Lead Incident Response. Strengthen Cyber Defense.

We are looking for an experienced SOC L2 professional to support advanced security monitoring, incident investigation, threat detection, and incident response activities across enterprise environments.

This role is ideal for experienced SOC and Cyber Defense professionals who can investigate complex security incidents, guide junior analysts, coordinate high-priority incident response, and continuously improve security operations.

Key Responsibilities

• Lead the investigation and resolution of complex security incidents escalated by L1 analysts.

• Perform root cause analysis, threat validation, and incident triage across enterprise environments.

• Act as a key responder during high-severity security incidents.

• Coordinate with CSIRT, engineering teams, and relevant stakeholders during incident response activities.

• Conduct threat hunting using Indicators of Compromise (IoCs) and threat intelligence.

• Mentor and guide SOC analysts through coaching, quality reviews, and incident-handling best practices.

• Collaborate with detection engineering teams to improve security use cases, alert quality, and SOC processes.

• Analyze security logs, network traffic, and security events across enterprise environments.

• Maintain incident documentation, reports, playbooks, and operational procedures.

• Contribute to continuous improvement of security monitoring and incident response processes.

Required Experience & Skills

• 3–5+ years of experience in a SOC, Incident Response, or Cyber Defense environment.

• Previous experience leading, mentoring, or supervising SOC analysts is highly preferred.

• Strong hands-on experience investigating security incidents using SIEM and security monitoring tools.

• Strong knowledge of network security, threat detection, malware analysis, incident response, and threat hunting.

• Experience analyzing logs, network traffic, and security events across enterprise environments.

• Ability to work effectively during high-priority security incidents.

• Strong communication and cross-functional coordination skills.

Preferred Qualifications

• Experience with CrowdStrike Falcon is highly preferred.

• Hands-on experience with SIEM platforms such as:

  • Splunk

  • Microsoft Sentinel

  • IBM QRadar

  • Google SecOps

  • Other comparable SIEM platforms

• Scripting experience using Python or PowerShell for automation and investigations.

• Security certifications such as Security+, CEH, GCIH, GCIA, or equivalent.

• Exposure to cloud security monitoring across AWS, Azure, or GCP.

Work Setup

• Hybrid work arrangement.

• Office location: Cubao, Manila.

• Must be amenable to a shifting schedule.

• Applicants must currently be based in the Philippines.

• Applicants must already have the legal right to live and work in the Philippines.

Recruitment Process

1. Screening with CV Reviewer

2. Endorsement for validation and further CV screening through Workday, including the HRI toolkit, FCV, and CV

3. Client review

Pre-Screening Questions

1. How many years of experience do you have in a SOC, Incident Response, or Cyber Defense environment?

2. Have you led, mentored, supervised, or guided SOC analysts? Please provide details.

3. What is your level of hands-on experience with SIEM platforms? Please mention the platforms you have worked with.

4. Do you have hands-on experience with CrowdStrike Falcon or other EDR/XDR tools?

5. What is your experience with incident response, threat hunting, and security incident investigation?

6. What is your last drawn salary?

7. What is your expected salary?

8. Are you willing to work in a hybrid setup in Cubao with a shifting schedule?

9. What is your current notice period?

Important: Please ensure that the latest version of the candidate's CV is uploaded in PDF format, along with screening notes based on the requirements of the JD.