SOC Analyst – Level 2

Netrust Philippines Corporation; Makati; On-site; PHP 600,000 - 1,000,000; Full time

Job summary

Netrust Philippines Corporation is seeking an experienced SOC Analyst Level 2 in Makati to lead advanced incident investigations, coordinate containment actions, and drive threat hunting across diverse log sources. You will tune SIEM rules, analyze malware/IOCs, and mentor junior analysts in a fast-paced SOC environment.

The role focuses on incident response, detection engineering, and collaboration with IT, cloud, and client teams to improve security posture and playbooks.

Qualifications

• Hands-on experience investigating security incidents.
• Experience with SIEM and EDR/XDR platforms.
• Strong understanding of networking, Windows, Linux, AD, cloud and identity security.
• Experience in a Managed SOC or MSSP environment is highly desirable.

Responsibilities

• Conduct advanced incident investigation and validate complex incidents.
• Coordinate containment actions and threat-hunting activities.
• Tune SIEM/analytics rules and improve detection coverage.
• Mentor L1 Analysts and review escalated cases for quality.
• Investigate malware, IOCs, and suspicious activity across logs and telemetry.
• Develop new detection use cases and improve SOC playbooks.

Skills

Incident investigation

SOC operations

Threat hunting

Detection engineering

Mentoring

Case reviews

Education

Bachelor's degree in IT/CS/C cybersecurity

Tools

SIEM platforms

EDR/XDR tools

Threat intel tools

Job description

Role Purpose

The SOC Analyst Level 2 is responsible for advanced investigation, incident analysis, threat hunting, response coordination, and technical escalation within the SOC.

The L2 Analyst acts as the primary escalation point for L1 Analysts and is responsible for validating complex incidents, determining root cause and scope, recommending or coordinating containment actions, and improving SOC detection capabilities.

Key Responsibilities

1. Advanced Incident Investigation

• Perform deep-dive analysis of escalated security incidents.
• Correlate events across multiple security technologies and log sources.
• Determine attack scope, affected users, systems, and business services.
• Analyze attacker behavior and map activities to relevant attack techniques.

2. Incident Response and Coordination

• Lead technical investigation of medium and high-severity incidents.
• Recommend containment, eradication, and recovery actions.
• Coordinate with IT, infrastructure, cloud, application, and client teams.
• Support incident communications and provide technical updates.

3. Threat Hunting

• Conduct proactive threat hunting using logs, telemetry, IOCs, and behavioral indicators.
• Identify suspicious activity not detected by existing security controls.
• Develop hypotheses and investigative queries.

4. Detection Engineering

• Tune SIEM and security analytics rules.
• Reduce false positives while maintaining detection coverage.
• Recommend and develop new detection use cases.
• Identify gaps in log sources and monitoring coverage.

5. Malware and IOC Analysis

• Analyze suspicious files, processes, URLs, domains, IP addresses, and hashes.
• Investigate persistence, lateral movement, credential abuse, and suspicious command execution.
• Use threat intelligence to validate potential malicious activity.

6. L1 Mentoring and Quality Assurance

• Provide guidance and technical support to L1 Analysts.
• Review escalated cases for quality and completeness.
• Conduct case reviews and knowledge-sharing sessions.
• Improve SOC playbooks and investigation procedures.

Required Qualifications

• Bachelor's degree in IT, Computer Science, Cybersecurity, or related field, or equivalent experience.
• Typically 3–5+ years of cybersecurity, SOC, incident response, security engineering, or threat hunting experience.
• Hands-on experience investigating security incidents.
• Experience with SIEM and EDR/XDR platforms.
• Strong understanding of networking, Windows, Linux, Active Directory, cloud, and identity security.
• Experience in a Managed SOC or MSSP environment is highly desirable.