SOC Analyst/Incident Response Analyst

PM Consulting; Metro Manila; On-site; PHP 320,000 - 520,000; Full time

Job summary

PM Consulting in the Philippines seeks a SOC Analyst / Incident Response Analyst to monitor security events, validate alerts, and escalate threats during nights and weekends. This role acts as a first-line defense across SIEM, identity, and endpoint platforms.

You will conduct initial investigations, document findings, and coordinate with Incident Response while maintaining detailed records and ensuring timely communications.

Qualifications

• Bachelor’s degree in Information Technology, Computer Science, Cybersecurity, or a related field.
• 1–2 years of experience in a SOC, Incident Response, or cybersecurity operations.

Responsibilities

• Perform initial alert triage and validate potential threats.
• Coordinate escalations to Incident Response teams.
• Review and correlate security logs to confirm incidents.
• Document investigations and hand off with clear summaries.
• Work with on-call staff during active investigations.
• Maintain accurate incident records in ticketing systems.

Skills

Security alert triage

Log analysis

SIEM familiarity

EDR knowledge

Incident reporting

Off-hour support ability

Education

Bachelor’s degree in Information Technology, Computer Science, Cybersecurity, or a related field

Tools

SIEM tools

EDR platforms

Security monitoring tools

Job description

About the job SOC Analyst/Incident Response Analyst

Job Overview
A growing technology services organization is looking for a SOC Analyst / Incident Response Analyst to support cybersecurity monitoring and incident validation activities during critical off-hour operations, including nights and weekends. This role serves as a first-line defense function responsible for identifying, investigating, and escalating potential security threats across multiple security and identity platforms.
The successful candidate will perform initial alert triage, validate suspicious activities, and coordinate escalations to the Incident Response team for confirmed threats.

Key Responsibilities
Security Monitoring & Alert Validation

• Monitor and review security alerts generated from SIEM, identity management, endpoint protection, password management, and cloud collaboration platforms
• Investigate alerts related to:
• Identity and authentication anomalies
• Compromised credentials or password-related incidents
• Impossible travel and restricted-country access events
• Privileged or administrator account creation activities
• Suspicious account access and administrative actions
• Potential unauthorized access or malicious behavior across enterprise systems
• Utilize ticketing and workflow automation platforms to track, validate, and document alerts
• Conduct manual investigations using security monitoring and log analysis tools
• Review and correlate security logs, endpoint activity, and system events to validate incidents
• Determine whether security events are false positives or confirmed threats
• Reconstruct user and system activity through available logs and telemetry data
• Coordinate with on-call Incident Response personnel during active investigations
• Escalate validated security incidents to the Incident Response team following established escalation procedures
• Prepare concise handoff summaries including affected users, systems, IP addresses, and relevant investigation findings
• Maintain accurate and detailed documentation within ticketing and incident management systems
• Ensure timely communication and escalation of critical security events

Qualifications

• Bachelor’s degree in Information Technology, Computer Science, Cybersecurity, or a related field
• At least 1–2 years of experience in a SOC, Incident Response, Cybersecurity Operations, or similar technical security role

Required Skills & Technical Experience

• Experience in security alert triage and incident investigation
• Familiarity with SIEM tools and log analysis methodologies
• Basic understanding of endpoint detection and response (EDR) platforms
• Ability to investigate suspicious user and system activity using log data
• Experience documenting incidents and communicating findings clearly
• Strong analytical and problem-solving skills
• Ability to work independently during off-hour support windows
• Strong attention to detail and investigative mindset
• Ability to manage multiple alerts and incidents simultaneously
• Effective written communication and incident reporting skills
• Comfortable working in a fast-paced security operations environment
• Willingness to work rotating night and weekend schedules as required