NOC Operations & Enablement Lead

CBTW; Pasay; On-site; PHP 600,000 - 1,000,000; Full time

Job summary

CBTW is seeking a NOC Operations & Enablement Engineer to orchestrate a single-pane-of-glass NOC in Pasay, Philippines. You will lead incident responses, runbooks, and visibility initiatives to tame alert noise and drive reliable service delivery.

You will triage 12,000+ alerts, define severities, author runbooks, and own cross-regional shift handoffs, with emphasis on MTTA/MTTR targets and continuous improvement.

Qualifications

• 5+ years of hands-on NOC, SRE, or IT operations in 24/7 monitored environments.
• Fluency with at least one observability platform and one ITSM tool (e.g., Splunk/Datadog and ServiceNow).
• Proven history of triaging incidents under pressure while following documented procedures.
• Strong ability to consolidate alerts and reduce noise to actionable items.
• Excellent written and verbal English for stakeholder communications and runbooks.

Responsibilities

• Operate and tune monitoring/alerting platforms and ITSM systems as daily environment.
• Triage at scale by grouping alerts to focus on top drivers and consolidate.
• Define and validate severity, ensuring consistency across the environment.
• Hunt blind spots by cross-referencing architecture with active alerts.
• Engineer signal with correlation rules, automated health updates, and runbooks.
• Execute runbooks precisely with adherence to procedures.
• Author and maintain L1 runbooks and test in live systems.
• Operate from a unified single-pane dashboard.
• Own shift handoffs with clear logs for Americas/APAC.
• Set standards for documentation, naming, and coverage targets.
• Respond to P1/P2 alerts within MTTA targets and escalate when needed.
• Coordinate incident bridges as commander and drive resolutions.
• Standardize incident coordination and reduce external dialing friction.
• Develop and improve the escalation matrix with SLAs.
• Capture post-incident learnings and feed fixes back into monitors.
• Deploy a centralized status page and automate health updates.
• Drive metrics toward stabilization exit criteria: accuracy, coverage, MTTA/MTTR.

Skills

Operational Foundation

Observability & ITSM fluency

Incident triage under pressure

Noise reduction instinct

Clear written communication

Shift flexibility (Americas night / AP

Job description

As a NOC Operations & Enablement Engineer, you will report to the NOC Lead and work closely with Program Leadership to operationalize our “single pane of glass” philosophy — where every alert that reaches an operator is signal, every action is backed by a runbook, and every P1/P2 incident has a commander.

We don’t need someone who just watches dashboards. We need a relentless noise-hunter with strong operational fundamentals — someone who can triage a chaotic landscape of 12,000+ alerts down to what actually matters, write the procedures everyone else follows, and stay calm in command when the environment is on fire.

Responsibilities

Observability & Alert Engineering

• Operate and tune monitoring/alerting platforms (e.g., Splunk, Zabbix) and ITSM systems (e.g., ServiceNow) as your daily working environment.
• Triage at scale. Group alerts by source, frequency, and component to isolate the ~20% of monitors driving ~80% of volume, and drive consolidation.
• Define and validate severity. Pre-classify alerts, confirm severity assignments with EWS SMEs, and keep the framework consistent across the environment.
• Hunt blind spots. Cross-reference environment architecture against active alerts to find critical systems with no coverage, and specify the monitors needed.
• Engineer signal. Build correlation / parent-child rules, automated health updates, and status-page integrations that remove manual overhead.

NOC Operations & Runbook Discipline

• Execute runbooks precisely and consistently for actionable alerts, with full adherence to documented procedures.
• Author and maintain runbooks. Translate actionable alerts into step-by-step, validated L1 procedures and test them in a live-system context.
• Operate from one clean view. Help shape and then work from a redesigned, unambiguous single-pane-of-glass NOC dashboard.
• Own shift handoffs. Maintain clean shift logs and handover notes so coverage across Americas / APAC is seamless.
• Set the standard. Define documentation, naming, and quality standards that sustain severity and runbook coverage targets.

Incident Command & Escalation

• Respond first. Acknowledge P1/P2 alerts within target MTTA, classify correctly, and act or upscale per the matrix without hesitation.
• Command incidents. Run P1/P2 bridges as incident commander — coordinate responders, drive communications, and push resolution toward MTTR targets.
• Standardize coordination. Deploy standardized incident bridges and resolve external dialing friction for customers.
• Build the IR process. Define and continuously improve the escalation matrix — mapping severity tiers to response teams, SLAs, and communication channels.
• Close the loop. Run post-incident learning, capture root cause, and feed fixes back into monitors and runbooks.

Visibility, Automation & Continuous Improvement

• Stand up visibility. Deploy and maintain a centralized status page providing real-time environment health.
• Automate the manual. Replace error-prone manual status updates with automated health rules.
• Drive the metrics. Push measurable progress against the stabilization exit criteria — alert rationalization, severity/runbook coverage, blind-spot elimination, and MTTA/MTTR.

Qualifications

Must-Haves

• Operational Foundation: 5+ years of hands-on NOC, SRE, or IT operations experience in a 24/7 monitored environment.
• Monitoring & ITSM Fluency: working depth in at least one observability platform (Splunk, Zabbix, Datadog, Grafana, or equivalent) and one ITSM tool (ServiceNow or equivalent).
• Incident Composure: a demonstrated history of triaging and resolving incidents under pressure while following — and improving — documented procedures.
• Noise-Reduction Instinct: you don’t tolerate alert chaos. You instinctively consolidate, correlate, and rationalize until what’s left is actionable.
• Communication & Clarity: ability to write clear runbooks and incident updates, and to explain operational status to non-technical stakeholders in professional English (U.S.-facing engagement).
• Shift Flexibility: able to work coverage aligned to Americas night / APAC daytime.

Nice-to-Haves

• Scripting/automation skills for health checks, status pages, or alert tuning (Python, shell, or platform-native).
• Incident command experience on P1/P2 bridges; familiarity with ITIL incident management.
• Experience with status-page tooling and automated health reporting.
• Exposure to correlation / AIOps tooling for alert noise reduction.
• Relevant certifications (ITIL, platform-specific monitoring, or cloud).