Lead Security Engineer – After-Hours IR & SOC

Vaco by Highspring; Philippines; On-site; PHP 700,000 - 1,100,000; Full time

Job summary

Hammerjack Pty Ltd is seeking a hands-on security analyst and incident responder to provide dedicated after-hours coverage for escalated alerts and incidents in a fast-moving managed services environment. The role supports 2nd/3rd shift coverage with potential 1st shift augmentation as needs evolve.

The ideal candidate will investigate, contain, document, and transition work cleanly, with 3+ years for mid-level or more for senior/lead roles, and will have experience across EDR, SIEM/XDR, and

Qualifications

• SOC and/or incident response experience, generally aligned to level: approximately 3+ years for mid-level hires, 5+ years for senior hires, and 7+ years for lead hires.
• Tier 2 capability: run investigations end-to-end with minimal oversight and sound escalation judgment
• Execution-oriented: able to perform containment, blocking, isolation, and basic remediation in small and mid-sized business environments
• Strong documentation discipline for investigative findings, decisions made, actions taken, and next steps

Responsibilities

• On-Shift (Steady State): Triage escalated alerts, validate severity, enrich with endpoint/identity/network/cloud context
• Document investigation notes and next steps
• During Incidents / Surge: Execute containment, collect/preserve evidence, log correlation for scope/impact
• Maintain eyes-on-glass continuity with clean shift handoffs
• Overflow / Bench Support: Detection tuning, playbook/runbook updates, baseline cleanup, config normalization, visibility improvements

Skills

Incident response

Triage & analysis

Documentation

Shift work readiness

EDR familiarity

Tools

Microsoft Defender

Entra ID

Microsoft 365

CrowdStrike

SentinelOne

LimaCharlie

WatchGuard

SonicWall

ConnectWise

Tines

Job description

Hammerjack Pty Ltd is seeking a hands-on security analyst and incident responder to provide dedicated after-hours coverage for escalated alerts and incidents in a fast-moving managed services environment. The role supports 2nd/3rd shift coverage with potential 1st shift augmentation as needs evolve.

The ideal candidate will investigate, contain, document, and transition work cleanly, with 3+ years for mid-level or more for senior/lead roles, and will have experience across EDR, SIEM/XDR, and