Securith Analyst

Lancesoft APAC; Cebu City; On-site; PHP 450,000 - 650,000; Full time

Job summary

Moder is seeking a Security Analyst / SOC Analyst in Cebu City to monitor security events, investigate incidents, and coordinate response across IT teams. The role requires hands-on SOC operations, SIEM/EDR tool usage, and collaboration with network, server, and application teams.

The candidate will work within a 24x7 SOC environment with flexible shift coverage. Responsibilities include threat detection, incident containment, vulnerability assessment, and security reporting.

Qualifications

• Bachelor's degree in engineering, Computer Science, Information Technology, Cybersecurity, or related discipline.
• 3–5 years of relevant cybersecurity/ SOC experience.
• Experience with SIEM, EDR, firewalls, and log analysis.

Responsibilities

• Monitor security alerts from SIEM/EDR/firewalls and other devices.
• Conduct end-to-end incident investigation and determine false positives vs true incidents.
• Use IBM QRadar or Splunk to correlate events and investigate activity.
• Perform root-cause analysis and manage incidents per IR frameworks.
• Monitor network traffic and logs to identify anomalous activity.
• Investigate user sign-ins and access privileges with Active Directory.
• Escalate incidents and track through resolution.
• Create and manage security tickets using ServiceNow or similar ITSM.

Skills

SOC operations

Log analysis

QRadar

Splunk

CrowdStrike

FortiGate

Active Directory

ServiceNow

Incident response

Vulnerability management

Education

Bachelor's degree in engineering, CS, IT, Cybersecurity

Tools

IBM QRadar

Splunk

CrowdStrike

FortiGate

Active Directory

ServiceNow

Job description

Security Analyst / SOC Analyst

About Us

Moder was founded in December 2020, with the mission to positively impact the financial health of companies in need by powering their in-house processes using top talent, workflow best practices, and progressive technology.

We are a tech forward outsourcing company specializing in supporting the US mortgage, insurance, and banking industries.

Moder offers end-to-end or component-based outsourcing. We can do everything from managing one-off projects to becoming an extension of your customer service or operations team.

Our team is built by outsourcing industry experts who've been on the client and provider sides. They bring decades of experience in financial services and expect the highest caliber of service and delivery from our team.

We're an American-owned company based in the US with offices in India, Philippines & Guatemala

Job Role:

Security Analyst / SOC Analyst

Job Title:

Security Analyst SOC

Department:

Information Security / Cybersecurity

Experience:

3 5 Years

Employment Type:

Full-Time

Shift:

Flexible / 24x7 SOC Support as required

Role Summary:

We are seeking an experienced Security Analyst to support Security Operations Center activities, including real-time security monitoring, incident detection, investigation, response, vulnerability assessment, and security event analysis. The candidate will work closely with infrastructure, network, server, and application teams to identify, investigate, contain, and remediate security threats while ensuring incidents are addressed within defined SLAs.

The role requires hands-on experience with SIEM platforms such as IBM QRadar and Splunk, endpoint security tools such as CrowdStrike, next-generation firewalls such as FortiGate, Windows/Linux environments, Active Directory, and ServiceNow. These technologies and responsibilities closely reflect the experience outlined in the attached profile.

Key Responsibilities:

• Monitor and analyze security alerts and events generated from SIEM, EDR, firewalls, IDS/IPS, proxy servers, antivirus solutions, databases, applications, Windows/Linux servers, and other network security devices.
• Perform end-to-end security incident investigation and determine whether security events represent false positives or true security incidents.
• Use SIEM platforms, particularly IBM QRadar and/or Splunk, to identify potential security breaches, correlate events, analyze logs, and investigate suspicious activity.
• Perform root cause analysis and manage incidents in accordance with established Incident Response and Incident Management frameworks.
• Monitor network traffic and security logs to identify anomalous behavior, attempted compromises, and potentially malicious activity.
• Investigate user activity, sign-in logs, and access privileges using Active Directory and related security controls.
• Escalate confirmed security incidents to appropriate infrastructure, network, server, application, and management teams and track incidents through closure.
• Create, manage, and track security incident tickets using Fresh service/Similar ticketing tool, ensuring incidents are resolved within agreed SLAs.
• Configure and onboard security logs from firewalls, IDS/IPS, Windows servers, Linux servers, databases, and applications into monitoring platforms.
• Conduct vulnerability assessments across operating systems, ports, applications, hardware, servers, and network infrastructure.
• Coordinate vulnerability scans for critical servers and applications on weekly, monthly, and quarterly schedules.
• Prepare vulnerability, remediation, security incident, compliance, and operational reports.
• Analyze daily and monthly incident management reports and support security compliance activities.
• Collaborate with Network, Infrastructure, Server, and Application teams to troubleshoot and remediate security issues.
• Participate in knowledge-sharing sessions, incident reviews, and lessons-learned discussions to improve SOC capabilities and security processes

Required Skills & Experience:

• 3 5 years of relevant experience in Cybersecurity, Information Security, or Security Operations.
• Strong understanding of SOC operations, security monitoring, incident investigation, incident response, and log analysis.
• Hands-on experience with IBM QRadar; exposure to Splunk preferred.
• Experience with Endpoint Detection & Response / Endpoint Security, preferably CrowdStrike.
• Experience monitoring and analyzing firewalls, IDS/IPS, proxies, antivirus, email security, servers, databases, and network security devices.
• Working knowledge of FortiGate or similar next-generation firewalls.
• Good understanding of Windows and Linux server security.
• Experience working with Active Directory, user access privileges, and authentication/sign-in logs.
• Experience with ServiceNow or equivalent ITSM/ticketing platforms.
• Understanding of vulnerability assessment, remediation tracking, and vulnerability reporting.
• Ability to differentiate false-positive and true-positive security alerts through detailed investigation.
• Knowledge of SLA-driven incident management and security escalation procedures.
• Strong analytical, troubleshooting, documentation, and communication skills.
• Education:
  Bachelor's degree in engineering, Computer Science, Information Technology, Cybersecurity, or a related discipline.
• Preferred Competencies:
  Strong analytical and problem-solving skills, attention to detail, ability to work effectively in a 24x7 SOC environment, effective collaboration across technical teams, strong incident documentation capabilities, and willingness to continuously learn emerging cybersecurity technologies and attack techniques.