SOC analyst

Commit; Manila; On-site; PHP 420,000 - 660,000; Full time

Job summary

Commit in Manila is seeking a Tier 1 SOC Analyst to monitor alerts, perform initial triage, and investigate security events across cloud and endpoint environments. This client-facing role requires strong English, excellent verbal communication, and the ability to clearly document findings and escalations.

Morning shifts aligned with East Asia hours. Candidates should have at least 1 year of hands-on SOC experience and familiarity with EDR and SIEM tooling.

Qualifications

• 1+ years of experience in SOC / Security Operations.
• Hands-on experience with EDR tools such as CrowdStrike, SentinelOne, or Microsoft Defender for Endpoint.
• Familiarity with SIEM platforms such as Splunk, Microsoft Sentinel, QRadar, or similar.
• Understanding of networking basics, including IP, DNS, HTTP/S, ports, and related concepts.
• Basic knowledge of Linux and Windows operating systems.
• Fluent English, both written and spoken - mandatory.
• Excellent verbal communication skills, especially in client-facing situations.

Responsibilities

• Monitor security alerts from SIEM, EDR, and cloud platforms.
• Perform initial triage and classification of alerts as true or false positives.
• Investigate suspicious activities across endpoints, identities, and cloud environments.
• Escalate confirmed incidents to Tier 2 / Incident Response teams with proper context.
• Analyze logs from CloudTrail, Azure Activity Logs, OS logs, and other sources.
• Document findings clearly in tickets and investigation reports.
• Follow playbooks and contribute to improving detection logic over time.
• Communicate clearly with internal teams and clients regarding alerts and escalations.

Skills

SOC operations

Threat monitoring

Incident triage

Client communication

English fluency

Tools

CrowdStrike

SentinelOne

Microsoft Defender for Endpoint

Splunk

Microsoft Sentinel

QRadar

Job description

Job Description:

We’re looking for a Tier 1 SOC Analyst to join our team and handle initial triage, monitoring, and investigation of security alerts across cloud and endpoint environments.

This is a client-facing role requiring strong English, excellent verbal communication skills, and the ability to clearly communicate findings and escalations. The position is intended for candidates with at least 1 year of hands-on SOC / Security Operations experience.

The role is based on morning shifts aligned with East Asia working hours.

Key Responsibilities:

• Monitor security alerts from SIEM, EDR, and cloud platforms
• Perform initial triage and classification of alerts as true or false positives
• Investigate suspicious activities across endpoints, identities, and cloud environments
• Escalate confirmed incidents to Tier 2 / Incident Response teams with proper context
• Analyze logs from multiple sources, including CloudTrail, Azure Activity Logs, OS logs, and other relevant security data sources
• Document findings clearly in tickets and investigation reports
• Follow existing playbooks and contribute to improving detection logic over time
• Communicate clearly with internal teams and clients regarding alerts, findings, and escalations

Requirements

Required Qualifications:

• 1+ years of experience in SOC / Security Operations
• Hands-on experience with EDR tools such as CrowdStrike, SentinelOne, or Microsoft Defender for Endpoint
• Familiarity with SIEM platforms such as Splunk, Microsoft Sentinel, QRadar, or similar
• Understanding of networking basics, including IP, DNS, HTTP/S, ports, and related concepts
• Basic knowledge of Linux and Windows operating systems
• Ability to analyze logs and identify suspicious behavior
• Fluent English, both written and spoken - mandatory
• Excellent verbal communication skills, especially in client-facing situations

Preferred Qualifications:

• Experience with cloud environments such as AWS, Azure, or GCP
• Knowledge of GCP / Google Cloud Platform - significant advantage
• Ability to investigate cloud activity, including IAM, API calls, and resource changes
• Understanding of identity-based attacks, such as token abuse and privilege escalation
• Experience with scripting in Python or Bash

Requirements: