Senior SOC Analyst — Hybrid, Lead Threat Hunting & IR

Citco Group of Companies; Makati; Hybrid; PHP 1,004,400 - 1,674,000; Full time

Job summary

Citco Group of Companies is seeking a Senior SOC Analyst in Makati for a hybrid setup. You will lead cybersecurity monitoring, threat detection, and incident response in a 24x7 CSIRT, mentoring junior analysts and guiding complex investigations across on-prem and cloud environments.

The role requires hands-on expertise with SIEM, EDR, and SOAR, strong knowledge of MITRE ATT&CK, and the ability to tune detections, develop playbooks, and communicate findings clearly to stakeholders.

Qualifications

• 3–5+ years of experience in a 24x7 SOC, CSIRT, or cyber incident response role in a global enterprise.
• Deep knowledge of SIEM, EDR and SOAR platforms and security automation tools.
• Familiarity with threat intelligence standards (e.g., STIX/TAXII) and frameworks like MITRE ATT&CK.
• Strong hands-on experience with forensic tools and utilities (e.g., Sysinternals, Wireshark).
• Proficient in scripting and automation (e.g., PowerShell, Python).
• Excellent verbal and written communication skills, especially for documentation, briefings, and reporting.
• Critical thinking and problem-solving skills with a high attention to detail.
• Preferred certifications: GCIH, GCIA, CEH, CySA+, or equivalent.
• Willingness to work flexible hours including weekends, holidays, and on-call as needed.

Responsibilities

• Serve as an escalation point for complex or high-risk security incidents.
• Lead end-to-end investigations involving malware, APTs, lateral movement, and insider threats.
• Conduct proactive threat hunting across on-prem and cloud environments using SIEM, EDR, and threat intelligence tools.
• Analyze logs, security telemetry, and packet captures across Windows, Linux, and network infrastructure.
• Enhance detection content and use cases by tuning SIEM and EDR rules aligned to frameworks such as MITRE ATT&CK.
• Develop, test, and maintain SOAR playbooks to improve investigation efficiency and automate response actions.
• Contribute to post-incident reviews and root cause analyses, proposing hardening and lessons learned initiatives.
• Conduct periodic evaluations of alert fidelity, detection coverage, and SOC operational metrics.
• Collaborate with IT, Engineering, and DevSecOps teams to validate threat findings, coordinate remediation, and improve preventative defenses.
• Lead knowledge transfer sessions and create training material for Junior SOC analysts.
• Assist the SOC Manager in evaluating security tools and recommending operational improvements.
• Maintain accurate and detailed documentation in the SOC’s case management system.
• Stay current on emerging threats, adversary TTPs, and detection techniques.

Skills

Threat analysis

Incident response

Mentoring juniors

Scripting

Communication

Problem solving

Tools

SIEM

EDR

SOAR

Sysinternals

Wireshark

Job description

Citco Group of Companies is seeking a Senior SOC Analyst in Makati for a hybrid setup. You will lead cybersecurity monitoring, threat detection, and incident response in a 24x7 CSIRT, mentoring junior analysts and guiding complex investigations across on-prem and cloud environments.

The role requires hands-on expertise with SIEM, EDR, and SOAR, strong knowledge of MITRE ATT&CK, and the ability to tune detections, develop playbooks, and communicate findings clearly to stakeholders.