SOC Analyst L2 - Incident Response & Detection

Staff4Me; Philippines; On-site; PHP 600,000 - 840,000; Full time

Job summary

Staff4me is seeking a SOC Analyst L2 in the Philippines to lead deeper investigations of escalated cases, confirm incidents, determine scope and impact, and drive containment actions with internal teams. You will produce high-quality technical communications and post-incident outputs, and contribute to detection improvements through playbooks updates.

The role requires 2-5 years in SOC/IR, strong networking fundamentals, EDR experience, and proficiency in English for clear stakeholder updates.

Qualifications

• 2-5 years in SOC/IR/Blue Team or equivalent incident handling experience.
• Solid fundamentals in networking: TCP/IP, DNS, HTTP/S, VPN, NAT.
• EDR investigations (process trees, persistence, LOLBins) and containment workflows.
• Windows/AD triage (authentication patterns, suspicious logon) and Linux triage.
• Network analysis and security controls (firewall/IDS/proxy/DNS).
• Proven ability to produce defensible scoping and timelines based on evidence.
• High documentation standards and ability to perform under pressure.
• Threat hunting experience and MITRE ATT&CK mapping.
• Detection engineering exposure (Sigma/YARA) and SIEM correlation strategy.
• Basic forensics concepts (acquisition, triage artifacts).
• Certifications aligned to Blue Team / IR (e.g., GCIH/GCIA, SC-200).
• Strong English (B2-High/C1) for technical calls and incident notes.

Responsibilities

• Take escalations from L1 and perform in-depth investigations: hypothesis-driven analysis, evidence validation, scoping, impact assessment, and timeline building.
• Correlate telemetry across endpoint (EDR), Windows/Linux, AD, firewall/proxy/DNS/IDS, and cloud logs.
• Recommend and coordinate containment actions following change control and governance.
• Determine severity and communicate clearly in English to technical stakeholders; provide concise executive updates.
• Identify detection gaps and drive improvements: reduce false positives and close false negatives.
• Ensure evidence integrity and proper documentation; coordinate handoffs with IR, IT Ops, Network, and Cloud teams.
• Produce post-incident deliverables: probable root cause, lessons learned, and preventive actions.

Skills

SOC/IR Experience

Threat Hunting

MITRE ATT&CK

English Communication

Detection Engineering

EDR Investigations

Forensics Basics

Tools

EDR

Windows/AD

Linux Triage

Firewall/IDS/Proxy

Sigma/YARA

SIEM

Job description

Staff4me is seeking a SOC Analyst L2 in the Philippines to lead deeper investigations of escalated cases, confirm incidents, determine scope and impact, and drive containment actions with internal teams. You will produce high-quality technical communications and post-incident outputs, and contribute to detection improvements through playbooks updates.

The role requires 2-5 years in SOC/IR, strong networking fundamentals, EDR experience, and proficiency in English for clear stakeholder updates.