Junior SOC Analyst (Shift work)

Expereo International; Taguig; On-site; PHP 300,000 - 540,000; Full time

Job summary

Expereo International is seeking a motivated Level 1 SOC Analyst with 1–2 years of security operations experience to join our Security team. You will monitor and triage security alerts, perform initial investigations, and escalate confirmed or suspicious activity in line with established playbooks.

You will collaborate closely with senior security team members. Responsibilities include monitoring SIEM, endpoint, and email security, performing triage, documenting cases, and supporting security

Qualifications

• Practical experience operating a SIEM in a Level 1 capacity.
• Hands-on exposure to enterprise security platforms such as Microsoft Defender, Elastic Security, Microsoft Sentinel, Splunk or CrowdStrike.
• Ability to search and interpret log data, and to draw conclusions from incomplete information.
• Understanding common attack techniques such as phishing, credential theft, malware delivery and social engineering.
• Email security fundamentals including message headers and sender authentication (SPF, DKIM, DMARC).
• Networking, Windows and Linux fundamentals sufficient to interpret host and network telemetry.
• Clear written English for case documentation and escalation.
• Methodical and consistent under repetitive workload, with sound judgement on when to upscale rather than proceed.

Responsibilities

• Monitor security alerts across SIEM, endpoint detection and email security platforms, and carry out initial triage and classification as benign, false positive, suspicious or confirmed incident.
• Perform initial investigation: gather evidence, correlate activity across endpoint, identity, email and network telemetry, and establish whether an alert represents genuine malicious activity.
• Investigate reported and quarantined email, analyze message headers, sender reputation, embedded links and attachments and action or elevate accordingly.
• Execute approved response playbooks for routine cases, and upscale indicators of compromise, lateral movement or data exposure to senior analysts with clear supporting evidence.
• Document each case: what was observed, the evidence gathered, the assessment reached and the action taken.
• Track open cases through to closure and ensure alerts are handled.
• Support security hygiene activity, including monitoring of security tooling coverage and follow-up on devices falling outside policy.
• Contribute to triage procedures, runbooks and operational reporting, and support awareness activities such as phishing simulation campaigns.

Skills

SIEM ops

Alert triage

Log analysis

Phishing basics

Email headers

Windows basics

Linux basics

English writing

Escalation decisions

Education

SC-200

CompTIA Security+

CompTIA Network+

Tools

Microsoft Defender

Elastic Security

Microsoft Sentinel

Splunk

CrowdStrike

Job description

We are theIntelligent Internet Platform.We connectPeople, PlacesandThingsanywhere,managing Internet Performancebetter than anyone else, while providingOne Global Experience,givingVisibility, ControlandSecuritythroughexpereoOne.

Expereo believes in the power of Internet connectivity. As the world's largest provider of managed internet, SD-WAN/SASE, and Cloud connectivity solutions, we power enterprises and government sites worldwide, helping to enhance every business' productivity with flexible and optimal Internet performance.

As a trusted partner of Fortune 500 enterprises, our continued aim and success in helping our customers and partners depends solely on the talented individuals who make Expereo a dynamic, effective, multicultural, and equitable environment.

About the role

We are looking for a motivated Level 1 SOC Analyst with one or two years experience in a security operations or similar technical role to join our Security team. You will be monitoring and triaging security alerts, carrying out initial investigation, and escalating confirmed or suspicious activity in line with established playbooks.You will work closely with senior security team members.

Responsibilities

• Monitor security alerts across SIEM, endpoint detection and email security platforms, and carry out initial triage and classification as benign, false positive, suspicious or confirmed incident.
• Perform initial investigation: gather evidence, correlate activity across endpoint, identity, email and network telemetry, and establish whether an alert represents genuine malicious activity.
• Investigate reported and quarantined email, analyze message headers, sender reputation, embedded links and attachments and action or elevate accordingly.
• Execute approved response playbooks for routine cases, and upscale indicators of compromise, lateral movement or data exposure to senior analysts with clear supporting evidence.
• Document each cases: what was observed, the evidence gathered, the assessment reached and the action taken.
• Track open cases through to closure and ensure alerts are handled.
• Support security hygiene activity, including monitoring of security tooling coverage and follow-up on devices falling outside policy.
• Contribute to triage procedures, runbooks and operational reporting, and support awareness activities such as phishing simulation campaigns.

Requirements

Essential Skills and Experience

• Practical experience operating a SIEM in a Level 1 capacity, alert queue management, triage, classification and escalation.
• Hands-on exposure to enterprise security platforms, such as Microsoft Defender, Elastic Security, Microsoft Sentinel, Splunk or CrowdStrike.
• Ability to search and interpret log data, and to draw conclusions from incomplete information.
• Understanding common attack techniques such as phishing, credential theft, malware delivery and social engineering.
• Email security fundamentals, including message headers and sender authentication (SPF, DKIM, DMARC).
• Networking, Windows and Linux fundamentals sufficient to interpret host and network telemetry.
• Clear written English for case documentation and escalation.
• Methodical and consistent under repetitive workload, with sound judgement on when to upscale rather than proceed.

Desirable

• Exposure to cloud security monitoring, particularly within Microsoft Defender and a plus (AWS environments).
• Query language knowledge in KQL, Lucene, EQL, or equivalent.
• Familiarity with the MITRE ATT&CK framework.・
• Experience with endpoint management or device compliance platforms.
• Entry-level certification such as SC-200, CompTIA Security+, CompTIA Network+ Blue Team Level 1.
• Basic scripting knowledge (PowerShell, Python).

Benefits

Beyond the Job

We're proud of our focus onEnvironment, Social and Governanceas well as the passion we display for the communities where we live and work.

EEO (Equal Employments Opportunities) Statement:

Expereo is an Equal Opportunities employer who aims to support and celebrate every employee that comes through our doors. We respect and support all of our people regardless of background, religion, nationality, sexual orientation, age, or physical condition.