Cybersecurity Operations Analyst

UL Solutions; Makati; On-site; PHP 600,000 - 900,000; Full time

Job summary

UL Solutions is seeking an experienced Cybersecurity SOC Operations Analyst in Makati to monitor, detect, and respond to security incidents across the IT environment. You will own cyber operations with minimal guidance, lead incident investigations, and collaborate with incident response teams to contain threats and restore operations.

Qualifications include 1–2+ years in a SOC, SIEM/EDR proficiency, and relevant certifications.

Qualifications

• 1–2+ years in a security operations center.
• College degree preferred.
• Experience with endpoint protection tools.
• Strong SIEM/EDR and O365 knowledge.
• At least one relevant security certification is highly preferred.
• Schedule may change based on team requirements.

Responsibilities

• Monitor security alerts, logs, and events from SIEM/IDS/firewalls to identify incidents.
• Analyze network traffic and logs to detect unauthorized access or malware.
• Triage and classify security events; escalate to appropriate teams.
• Investigate suspicious email submissions and initial incident response.
• Document incident details, timelines, and actions taken.
• Maintain runbooks and contribute to monthly trend reports.

Skills

Security monitoring

Incident response

Threat intelligence

Runbooks

SIEM

EDR

O365

Collaboration

Leadership

Documentation

Education

Bachelor’s degree

Tools

SIEM tools

EDR tools

Ticketing system

Case management

O365 ecosystem

Job description

As a Cybersecurity SOC (Security Operations Center) Operations Analyst, you will be responsible for monitoring, detecting, and responding to security incidents within the organization's IT environment. You will play a crucial role in maintaining the security posture of the organization by identifying and mitigating potential threats and vulnerabilities. This position requires a strong understanding of cybersecurity principles, technologies, and incident response procedures. Additionally, as a senior‑level analyst, you should be able to independently take ownership of all aspects of cyber operations functions with minimal guidance from your manager.

Responsibilities

• Security Monitoring and Incident Detection:
• Monitor security alerts, logs, and event data from various sources, such as SIEM systems, intrusion detection systems (IDS), and firewalls, to identify potential security incidents.
• Analyze network traffic, system logs, and other relevant data to detect unauthorized access attempts, malware infections, or other suspicious activities.
• Investigate and triage security events, classify incidents, and escrow critical issues to the appropriate teams for further analysis and response.
• Analyze user reported emails.
• Initial Incident Response and Investigation:
• Respond to and analyze suspicious email submissions.
• Respond to security incidents in a timely and effective manner, following established incident response procedures and playbooks.
• Conduct detailed analysis and investigation of security incidents, determining the root cause, extent of compromise, and impact on the organization's systems and data.
• Collaborate with incident response teams to contain and mitigate security incidents, minimize the impact, and restore normal operations.
• Threat Intelligence and Research:
• Stay updated on the latest cybersecurity threats, vulnerabilities, and attack techniques through research, threat intelligence feeds, and industry reports.
• Analyze threat intelligence data to identify emerging threats, indicators of compromise (IOCs), and potential vulnerabilities that may affect the organization's systems.
• Leverage threat intelligence insights to proactively improve security controls, detect advanced threats, and strengthen the organization's security posture.
• Security Incident Reporting and Documentation:
• Prepare accurate and comprehensive incident reports, documenting incident details, analysis findings, response actions taken, and recommended improvements.
• Maintain incident documentation, including evidence logs, incident timelines, and any other relevant information required for compliance and auditing purposes.
• Collaborate with stakeholders to communicate incident updates, impact assessments, and recommended remediation strategies.
• Maintain operational knowledge base and runbooks.
• Thought leadership:
• Lead relevant projects and act as a resource for colleagues with less experience.
• Provide summary reports of monthly trends and noteworthy incidents.
• Provide cybersecurity recommendations to leadership based on significant threats and vulnerabilities.
• Conduct research, analysis, and correlation across a wide variety of all source data sets (indications and warnings).
• Other task:
• Handle internal tickets under Cybersecurity responsibility.

Qualifications

• Read and follow the Underwriters Laboratories Code of Conduct and all physical and digital security practices.
• 1‑2+ years' experience working in a security operations center.
• College degree preferred.
• Experience working with endpoint protection tools, case management/ticketing tools.
• Strong understanding and usage of SIEM, EDR, O365 Ecosystem & Ticketing system.
• Ability to document and create runbooks and generate reports.
• At least one relevant security certification highly required.
• The schedule may change based on team requirements and operational needs.
• Perform other duties as directed.

About Us

A global leader in applied safety science, UL Solutions (NYSE: ULS) transforms safety, security and sustainability challenges into opportunities for customers in more than 110 countries. UL Solutions delivers testing, inspection and certification services, together with software products and advisory offerings, that support our customers’ product innovation and business growth. The UL Mark serves as a recognized symbol of trust in our customers’ products and reflects an unwavering commitment to advancing our safety mission. We help our customers innovate, launch new products and services, navigate global markets and complex supply chains, and grow sustainably and responsibly into the future. Our science is your advantage.

About The Team

As we’re supporting some of the most innovative companies in the world, high‑performing IT is vital. Deeply focused on technology innovation and practically applying new and emerging technologies to meet the evolving needs of our customers, we operate as strategic partners to the wider organization, developing and delivering best‑in‑class IT solutions. We also use our expertise day‑to‑day to offer our colleagues a seamless technology experience, providing them with the tools to help customers all over the world deliver safer, more sustainable solutions. Join our team and connect, support and empower colleagues across our global community.