Senior GSOC L3 Analyst: 24/7 Cyber Defense Lead

Willis Towers Watson; Pateros; On-site; PHP 800,000 - 1,200,000; Full time

Job summary

Willis Towers Watson is seeking an experienced L3 SOC analyst to oversee 24/7 cyber defence operations. You will triage alerts, investigate incidents, and coordinate responses to minimise impact across the business.

You will lead investigations, communicate with technical and non-technical stakeholders, and mentor L1/L2 teams while refining playbooks and detection rules to strengthen security posture.

Qualifications

• 6+ years in a mature cyber defence/GSOC environment.
• Strong troubleshooting and analytical skills, able to communicate under pressure.
• Experience leading investigations and coordinating with stakeholders.
• Hands-on with SIEM/UEBA/EDR and incident response.
• Knowledge of attacker techniques and security tooling.
• Proven ability to create actionable incident reports.

Responsibilities

• Oversee monitoring, investigation, containment, and eradication of cyber threats.
• Lead GSOC team via log analysis using SIEM/UEBA/EDR tooling.
• Determine and drive response actions to mitigate threats.
• Escalate/high- priority incidents and ensure timely handling.
• Coordinate with technical and business teams to minimize impact.
• Provide guidance to L1/L2 analysts and conduct handovers.
• Contribute to playbooks, knowledge bases and KRIs.
• Participate in on-call rotation for high-severity alerts.

Skills

Analytical thinking

Calm under pressure

Excellent communication

Leadership

Mentoring & coaching

Problem solving

Stakeholder management

Troubleshooting

Team collaboration

Technical curiosity

Education

MSc in security field

Tools

SIEM

UEBA

EDR

Python

PowerShell

Wireshark

EnCase

X-Ways

Job description

Willis Towers Watson is seeking an experienced L3 SOC analyst to oversee 24/7 cyber defence operations. You will triage alerts, investigate incidents, and coordinate responses to minimise impact across the business.

You will lead investigations, communicate with technical and non-technical stakeholders, and mentor L1/L2 teams while refining playbooks and detection rules to strengthen security posture.