Senior MDR Analyst (Tier 3 - SOC Analyst)

Penbrothers International; Philippines; Vor Ort; PHP 700.000 - 1.000.000; Vollzeit

Zusammenfassung

Penbrothers International is seeking a seasoned SOC Analyst to defend client environments, conduct advanced investigations with CrowdStrike and SIEMs, and drive incident response improvements. You will own incidents end-to-end, perform threat hunting, and collaborate with security teams to strengthen MDR capabilities.

The ideal candidate brings 3–5 years in SOC operations, strong MITRE ATT&CK knowledge, and experience with leading SIEM/EDR/SOAR tools.

Qualifikationen

• Bachelor's degree in IT/CS/Cybersecurity or equivalent experience.
• Expertise in investigating and mitigating security incidents across diverse environments (on-prem, cloud, hybrid).
• 2–3+ years as a SOC analyst or in MDR/MSSP context.
• Strong understanding of threat intelligence, adversary TTPs, and MITRE ATT&CK.
• Certifications such as Security+, CySA+, CC/SSCP, ECIH, GCIH are a plus.
• Advanced English (C1) communicated effectively.
• 3–5 years hands-on SOC operations experience.
• Proficiency with SIEM, EDR/XDR, and SOAR technologies; security incident response.

Aufgaben

• Lead advanced security investigations to determine attack vectors and scope.
• Perform advanced EDR analysis and context-rich threat recon.
• Conduct targeted threat hunting and analyze IoCs and TTPs.
• Own incidents from investigation through remediation planning and execution.
• Make containment decisions and autonomously implement actions when warranted.
• Provide actionable remediation guidance and assist in recovery efforts.
• Manage security escalations and coordinate with stakeholders for rapid resolution.
• Translate findings into clear incident summaries for customers and teams.
• Maintain thorough incident documentation and evidence trails.
• Leverage threat intel and monitoring tools to improve detection and response.

Kenntnisse

Advanced English

SOC operations experience

Threat intelligence integration

MITRE ATT&CK framework knowledge

Ausbildung

Bachelor degree in IT/CS/Cybersecurity

Tools

SIEM (Chronicle, Splunk, IBM QRadar)

EDR/XDR (CrowdStrike, SentinelOne, Trellix)

SOAR platforms (Chronicle, FortiSOAR, Splunk SOAR)

Jobbeschreibung

About Penbrothers

Penbrothers is an HR & remote talent management partner and one of the fastest-growing companies in the Philippines. We provide talented Filipinos with global opportunities in high-growth startups and dynamic companies, from the comfort of their own homes.

About The Role

As SOC Analyst, Consultant you will create and maintain the safest operating environment for the client, employees and clients. You will defend network boundaries, keep computer systems and network devices hardened against attacks and provide security services to protect sensitive data (e.g., passwords and customer information). You will monitor our systems for attacks and intrusions and work to proactively identify flaws and

What You Will Do

• Lead Advanced Security Investigations: Conduct in-depth investigations of escalated security incidents using CrowdStrike Falcon and other relevant log sources to determine how an attack occurred, identify the initial access point, trace subsequent malicious activity, and establish the full scope of compromise across affected endpoints, systems, and user accounts.
• Perform Advanced EDR Analysis: Investigate and analyze security detections beyond initial alert validation, leveraging endpoint telemetry, process execution data, and related indicators to reconstruct attacker activity, assess threats, and determine the nature and severity of incidents.
• Execute Threat Hunting and Detection Analysis: Perform targeted threat hunting, analyze indicators of compromise (IoCs), and assess adversary tactics, techniques, and procedures (TTPs) to identify malicious activity, validate threats, and support improvements to detection and prevention capabilities.
• Own Incidents Through Remediation Recommendations: Take ownership of escalated incidents from initial investigation through containment and remediation planning. Develop evidence-based assessments, determine root causes where possible, and provide clear, actionable recommendations to customers to support effective incident resolution.
• Make Independent Containment Decisions: Assess incident severity, available evidence, potential business impact, and customer authorization boundaries to determine appropriate containment and response actions. Independently execute authorized actions, including endpoint isolation, blocking malicious indicators, and disabling compromised accounts when warranted.
• Provide Actionable Remediation Guidance: Recommend appropriate eradication and recovery measures, including patching, system rebuilding, configuration changes, and other corrective actions for implementation by the customer or designated internal teams. Clearly communicate the urgency, rationale, and potential impact of recommended actions.
• Manage Security Escalations: Independently assess, prioritize, and route incidents requiring customer review, urgent incident escalation, or assistance from management and specialized internal teams. Recognize active hands-on-keyboard activity and other high-risk scenarios that require immediate escalation, ensuring timely communication and appropriate ownership.
• Communicate Findings to Customers and Stakeholders: Translate technical investigation findings into clear incident summaries, explain the attack path and scope of compromise, communicate containment decisions, and present prioritized recommendations to customers and relevant stakeholders.
• Maintain Incident Documentation: Document investigation findings, supporting evidence, affected assets and accounts, containment actions, escalation decisions, incident timelines, and remediation recommendations in accordance with established operational procedures and customer requirements.
• Leverage Security Tools and Threat Intelligence: Maintain strong working knowledge of EDR/XDR, SIEM, and relevant security monitoring platforms, using available telemetry and threat intelligence to support investigations, validate malicious activity, and improve incident handling effectiveness.
• Improve MDR Operations and Detection Capabilities: Contribute to the continuous improvement of investigation playbooks, standard operating procedures, response workflows, and detection logic. Identify opportunities to improve alert quality, investigation efficiency, escalation practices, and the overall effectiveness of the MDR service.
• Collaborate Across Security and Technical Teams: Work closely with customers, SOC colleagues, security engineering, IT, and other technical teams to coordinate incident handling, validate findings, facilitate remediation, and resolve complex security issues.
• Participate in Rotational and After-Hours Coverage: Support after-hours and on-call incident escalation and response requirements, ensuring timely investigation, sound response decisions, and effective incident coordination.

Qualifications:

• Bachelor degree in information technology, Computer Science, Cybersecurity, or a related discipline, or equivalent professional experience.
• Expertise in investigating and mitigating security incidents across diverse environments, including on-premises, cloud, and hybrid infrastructures.
• An experienced (Level 2 or 3) Analyst, looking to develop and grow a SOC service and team.
• Strong understanding of threat intelligence integration, adversary TTPs, and the MITRE ATT&CK framework.
• Desired Certifications: CompTIA Security+ and Cybersecurity Analyst (CySA+), ISC2 CC and SSCP, EC-Council Certified Incident Handler (ECIH), GIAC Certified Incident Handler (GCIH), and SIEM/EDR certifications (e.g., Splunk, Chronicle, CrowdStrike, SentinelOne) are a plus.
• Advanced English (C1).
• 3–5 years of hands-on experience in SOC operations, preferably for a SOC or MDR service provider (e.g.,MSSP).
• Proficiency with SOC technologies, including SIEM (e.g., Chronicle, Splunk, IBM QRadar), EDR/XDR (e.g.,Trellix, CrowdStrike, SentinelOne, BlackPoint), and SOAR platforms (e.g., Chronicle, FortiSOAR, Splunk SOAR).
• Experience responding to alerts related to Microsoft Office 365, Identities (Entra ID, Active Directory),Cloud (AWS, Azure), Firewalls, Endpoint security, Email security, Web security (IP, DNS Filtering).