Security Operations Center Analyst

Netrust Philippines Corporation; Makati; On-site; PHP 800,000 - 1,200,000; Full time

Job summary

Netrust Philippines Corporation in Makati, Philippines is seeking a SOC Analyst Level 2 to perform advanced incident investigation, threat hunting, and incident response coordination. The role focuses on validating complex cases, determining root cause, coordinating containment, and improving SOC detection capabilities.

The ideal candidate has hands-on incident investigation experience, strong SIEM/EDR skills, and a solid understanding of networking, Windows, Linux, Active Directory, and cloud

Qualifications

• Bachelor's degree in IT, Computer Science, Cybersecurity, or related field, or equivalent experience.
• 3–5+ years of cybersecurity, SOC, incident response, security engineering, or threat hunting experience.
• Hands-on experience investigating security incidents.
• Experience with SIEM and EDR/XDR platforms.
• Strong understanding of networking, Windows, Linux, Active Directory, cloud, and identity security.
• Experience in a Managed SOC or MSSP environment is highly desirable.

Responsibilities

• Advanced Incident Investigation: deep-dive analysis of escalated security incidents.
• Incident Response & Coordination: lead technical investigation and containment actions.
• Threat Hunting: proactive log reviews and hypothesis testing.
• Detection Engineering: tune rules, reduce false positives, expand detection coverage.
• Malware and IOC Analysis: analyze hashes, URLs, domains, and attacker TTPs.
• L1 Mentoring & QA: guide L1 analysts and improve playbooks and procedures.

Skills

Incident investigation

Threat hunting

Detection engineering

Mentoring

Incident response coordination

Network security basics

Education

Bachelor's degree in IT/CS/Cybersecurity or related field

Tools

SIEM

EDR/XDR

Job description

The SOC Analyst Level 2 is responsible for advanced investigation, incident analysis, threat hunting, response coordination, and technical escalation within the SOC.

The L2 Analyst acts as the primary escalation point for L1 Analysts and is responsible for validating complex incidents, determining root cause and scope, recommending or coordinating containment actions, and improving SOC detection capabilities.

Key Responsibilities

1. Advanced Incident Investigation

• Perform deep-dive analysis of escalated security incidents.
• Correlate events across multiple security technologies and log sources.
• Determine attack scope, affected users, systems, and business services.
• Analyze attacker behavior and map activities to relevant attack techniques.

2. Incident Response and Coordination

• Lead technical investigation of medium and high-severity incidents.
• Recommend containment, eradication, and recovery actions.
• Coordinate with IT, infrastructure, cloud, application, and client teams.
• Support incident communications and provide technical updates.

3. Threat Hunting

• Conduct proactive threat hunting using logs, telemetry, IOCs, and behavioral indicators.
• Identify suspicious activity not detected by existing security controls.
• Develop hypotheses and investigative queries.

4. Detection Engineering

• Tune SIEM and security analytics rules.
• Reduce false positives while maintaining detection coverage.
• Recommend and develop new detection use cases.
• Identify gaps in log sources and monitoring coverage.

5. Malware and IOC Analysis

• Analyze suspicious files, processes, URLs, domains, IP addresses, and hashes.
• Investigate persistence, lateral movement, credential abuse, and suspicious command execution.
• Use threat intelligence to validate potential malicious activity.

6. L1 Mentoring and Quality Assurance

• Provide guidance and technical support to L1 Analysts.
• Review escalated cases for quality and completeness.
• Conduct case reviews and knowledge-sharing sessions.
• Improve SOC playbooks and investigation procedures.

Required Qualifications

• Bachelor's degree in IT, Computer Science, Cybersecurity, or related field, or equivalent experience.
• Typically 3–5+ years of cybersecurity, SOC, incident response, security engineering, or threat hunting experience.
• Hands-on experience investigating security incidents.
• Experience with SIEM and EDR/XDR platforms.
• Strong understanding of networking, Windows, Linux, Active Directory, cloud, and identity security.
• Experience in a Managed SOC or MSSP environment is highly desirable.