SOC Team Lead/ Security Information (SIEM) Platform Operation

We’re looking for an experienced SOC L2 professional to join a cybersecurity team and play a key role in detecting, investigating, and responding to advanced security threats.  Lead Incident Response. Strengthen Cyber Defense.

This role is ideal for experienced SOC professionals who have strong hands-on incident response experience and enjoy mentoring analysts, handling complex security incidents, and continuously improving security operations.

Location: Cubao, Quezon City
Work Setup: Hybrid
Work Schedule: Shifting
Level: SOC Level 2

What You'll Do

• Lead the investigation and resolution of complex security incidents escalated by L1 analysts.

• Perform incident triage, threat validation, and root cause analysis across enterprise environments.

• Act as a key responder during high-severity security incidents.

• Coordinate with CSIRT, engineering teams, and other stakeholders during incident response.

• Conduct threat hunting using Indicators of Compromise (IoCs) and threat intelligence.

• Analyse security logs, network traffic, and security events.

• Mentor and guide SOC analysts through coaching, quality reviews, and incident-handling best practices.

• Collaborate with detection engineering teams to improve alert quality, use cases, and SOC processes.

• Maintain incident documentation, reports, playbooks, and operational procedures.

What We're Looking For

• 3–5+ years of experience in SOC, Incident Response, or Cyber Defense.

• Previous experience leading, mentoring, or supervising SOC analysts is highly preferred.

• Strong hands-on experience investigating security incidents using SIEM and security monitoring tools.

• Knowledge of:

  • Network Security

  • Threat Detection

  • Malware Analysis

  • Incident Response

  • Threat Hunting

• Experience analysing logs, network traffic, and security events in enterprise environments.

• Ability to work effectively during high-priority security incidents and coordinate cross-functional response efforts.

⭐ Preferred Qualifications

• Experience with CrowdStrike Falcon is highly preferred.

• Hands-on experience with SIEM platforms such as:

  • Splunk

  • Microsoft Sentinel

  • IBM QRadar

  • Google SecOps

  • Similar SIEM platforms

• Scripting experience using Python or PowerShell.

• Certifications such as Security+, CEH, GCIH, GCIA, or similar.

• Exposure to cloud security monitoring across AWS, Azure, or GCP.

Work Arrangement

• Hybrid setup in Cubao

• Must be amenable to shifting schedules

• Applicants must currently be in the Philippines and have the legal right to live and work in the country.

Interested and qualified? Send your updated CV.

Note: This role requires solid hands-on SOC L2/incident response experience. Candidates without relevant SOC, cyber defence, or incident response experience may not be considered.