SOC Analyst II

Kinettix, Inc.; Cebu City; On-site; PHP 600,000 - 900,000; Full time

Job summary

Kinettix, Inc. seeks a SOC Analyst II to monitor security events and coordinate incident response across the organization’s environment. You will work with Defender XDR, Wazuh, Entra ID, Purview, and Keeper to detect threats and investigate alerts.

In this role, you will lead containment and recovery efforts, mentor SOC Analyst I, and help improve detection rules, processes, and reporting for management and auditors.

Qualifications

• Bachelor's degree in a related field.
• 2–4 years of experience in Security Operations/Incident Response.
• Experience with SIEM/EDR/XDR and security monitoring platforms.

Responsibilities

• Monitor and investigate security alerts from Defender XDR, Wazuh, Entra ID, Purview, Keeper, and others.
• Analyze and respond to security incidents including phishing, malware, and account compromises.
• Perform threat hunting to identify threats and indicators of compromise.
• Lead incident response activities: containment, eradication, and recovery.
• Investigate identity and access events in Entra ID including suspicious sign-ins and privileged access.
• Monitor and respond to DLP alerts via Purview.
• Support vulnerability management by validating findings and coordinating remediation.
• Develop and tune detection rules and incident procedures.
• Document incidents and provide recommendations to management.
• Support security audits and customer requirements using platforms like Vanta.
• Provide mentoring to SOC Analyst I and collaborate with IT, Security, Compliance, and business teams.

Skills

Security Operations

Incident Response

Threat Detection

Threat Hunting

Security Monitoring

Education

Bachelor's Degree in Cybersecurity, IT, CS, or related field

Tools

SIEM

EDR

XDR

Microsoft Defender XDR

Wazuh

Microsoft Entra ID

Microsoft Purview

Keeper

Vanta

Job description

The SOC Analyst II is responsible for monitoring, investigating, and responding to cybersecurity threats and incidents across the organization's environment. This role serves as an escalation point for complex security events and helps strengthen the organization's security posture through threat detection, incident response, threat hunting, and continuous improvement of security processes.

Job Responsibilities:

• Monitor and investigate security alerts from Microsoft Defender XDR, Wazuh, Microsoft Entra ID, Microsoft Purview, Keeper, and other security tools.
• Analyze and respond to security incidents, including phishing attacks, malware infections, account compromises, unauthorized access attempts, and suspicious activities.
• Perform threat hunting activities to proactively identify potential threats and indicators of compromise.
• Lead incident response activities, including containment, eradication, recovery, and root cause analysis.
• Investigate identity and access-related security events within Microsoft Entra ID, including suspicious sign-ins, privileged access activities, and account takeover attempts.
• Monitor and respond to data protection and Data Loss Prevention (DLP) alerts through Microsoft Purview.
• Support vulnerability management efforts by validating findings and coordinating remediation with system owners.
• Develop and improve detection rules, alert tuning, investigation procedures, and security monitoring processes.
• Document incidents, investigations, findings, and recommendations in accordance with established procedures.
• Prepare security reports and provide updates to management and relevant stakeholders.
• Support security audits, compliance assessments, and customer requirements using platforms such as Vanta.
• Provide technical guidance and mentoring to SOC Analyst I team members.
• Collaborate with IT, Security, Compliance, and business teams to improve security controls and operational effectiveness.
• Recommend and implement enhancements to security technologies, processes, and SOC operations.

Job Qualifications:

• Bachelor's Degree in Cybersecurity, Information Technology, Computer Science, or a related field.
• Two (2) to four (4) years of experience in Security Operations, Incident Response, or Cybersecurity.
• Experience with SIEM, EDR, XDR, and security monitoring platforms.
• Strong understanding of: Incident Response Threat Detection and Analysis Network Security Identity and Access Management Vulnerability Management Knowledge of the MITRE ATT&CK Framework.
• Preferred Experience with: Microsoft Sentinel/Wazuh Microsoft Defender XDR Microsoft Entra ID Azure Security Services