Security Operations Analyst II

Vertiv Co; Mandaluyong; On-site; PHP 480,000 - 720,000; Full time

Job summary

Vertiv Co in Manila is seeking a SOC Analyst II to monitor, detect, investigate, and respond to security incidents, acting as escalation from Tier 1. You will work with SIEM, SOAR, and threat intelligence to strengthen detections and playbooks.

The role also involves mentoring junior analysts, coordinating with Incident Response, Threat Intelligence, and Security Engineering, and ensuring timely containment and remediation.

Qualifications

• Bachelor's degree in CS/CE/IT or equivalent.
• 3-5 years in cybersecurity/SOC operations or similar.
• Certifications such as CompTIA Security+, CEH, GSEC, or equivalent.
• Proficient with SIEM, IDS/IPS, firewalls and endpoint protection solutions.

Responsibilities

• Monitor events and alerts from SIEM, SOAR, 7AI Dashboard and other security tools.
• Analyze escalated alerts to determine legitimacy, scope, and impact.
• Correlate logs across SIEM, EDR, network, cloud, and identity platforms.
• Investigate incidents to determine impact and root cause.
• Coordinate containment and remediation with stakeholders as needed.
• Develop and implement incident response procedures and playbooks.
• Mentor junior analysts and support 24/7 monitoring.

Skills

Analytical thinking

Communication skills

Documentation

Education

Bachelor's degree in CS/CE/IT

Tools

SIEM tools

IDS/IPS

Firewalls

Endpoint protection

Cloud security

Job description

Job (Assignment) Title: SOC Analyst II

Function/Department: Security / Information Technology

Reports To: Manager Security Operations and Engineering

POSITION SUMMARY

1. The SOC Analyst II is responsible for overseeing cybersecurity by monitoring, detecting, investigating, and responding to security incidents within an organization. And act as an escalation from Tier 1 analyst. This role focuses on incident analysis, threat validation, containment actions, and root cause identification, while supporting continuous improvement of SOC detections, playbooks, and threat intelligence integration.

The Level II analyst acts as a technical escalation point, mentoring junior analysts and collaborating closely with Incident Response, Threat Intelligence, and Security Engineering teams

RESPONSIBILITIES

1. Monitor security events and alerts from SIEM (Security Information and Event Management) systems/ SOAR, 7AI Dashboard and other security tools.
2. Perform deep-dive analysis of security alerts escalated by Tier 1 to determine legitimacy, scope, and impact
3. Conduct log correlation and forensic analysis across SIEM, EDR, network, cloud, and identity platforms
4. Analyze and investigate security incidents to determine their impact and root cause.
5. Respond to security incidents, coordinate with stakeholders, and elevate as necessary.
6. Conduct risk analysis to identify security gaps.
7. Develop and implement incident response procedures and playbooks.
8. Collaborate with IT and security teams to improve security configurations and defenses.
9. Document security incidents, findings, and recommendations for future mitigation.
10. Stay updated on the latest cybersecurity threats, trends, and best practices.
11. Identify Indicators of Compromise (IOCs) and attack patterns using threat intelligence and MITRE ATT&CK
12. Execute containment and remediation actions (e.g., isolate hosts, block indicators, disable accounts)
13. Work with our Security Engineering group for any security application and tools within SOC for enhancement or fine tuning.
14. Assist in threat hunting and proactive security monitoring.
15. Participate in security awareness training and initiatives.

QUALIFICATIONS

1. Candidate must be a degree holder in Computer Science, Computer Engineering, Information Technology or equivalent qualifications
2. 3-5 years of experience in cybersecurity, SOC operations, or a similar role.
3. Security certifications such as CompTIA Security+, CEH, GSEC, or equivalent.
4. Familiarity with SIEM tools, IDS/IPS, firewalls, and endpoint protection solutions.
5. Knowledge of cybersecurity frameworks such as NIST, MITRE ATT&CK, or ISO 27001.
6. Understanding of networking protocols, operating systems, and security best practices.
7. Strong analytical and problem-solving skills.
8. Strong understanding of incident response lifecycle (NIST / SANS)
9. Hands-on experience with log analysis, endpoint telemetry, and network traffic analysis
10. Ability to analyze malware behavior, lateral movement, persistence, and privilege escalation
11. Excellent communication and documentation abilities.
12. Experience with scripting languages (Python, PowerShell, etc.) for automation.
13. Knowledge of cloud security (AWS, Azure, Google Cloud).
14. Familiarity with forensic analysis and malware investigation techniques.
15. Rotational shifts may be required to support 24/7 security monitoring.
16. Ability to work in a fast-paced and high-pressure environment.