SOC L1/Tech Support

Solaire Resort; Parañaque; On-site; PHP 300,000 - 420,000; Full time

Job summary

Solaire Resort in Parañaque, Philippines seeks a Security Operations Center Analyst to monitor and respond to security events on a 24/7 shift. You will analyze alerts from SIEM, classify incidents, and document actions taken.

Collaborate with L1/L2 teams, perform initial triage, escalate complex cases, and contribute to reducing false positives. A foundational knowledge of networking, Windows/Linux, and common attack techniques is required.

Qualifications

• Education: Bachelor’s degree in computer science, information technology, or a related field, or equivalent practical experience.
• Experience: 0–2 years in security operations, IT support, or network/system administration; willing to work on a 24/7 shift rotation.
• Skills & Knowledge: Foundational knowledge of networking, Windows and Linux OS, and common attack techniques; familiarity with SIEM platforms and ticketing tools.
• Certifications (good to have): CompTIA Security+, CompTIA CySA+, or Microsoft SC-200 preferred.

Responsibilities

• Monitor SIEM dashboards, alerts, and security events across network, endpoint, cloud, and application log sources on a 24/7 shift rotation.
• Perform initial triage, classification, and prioritization of security alerts following documented playbooks and runbooks.
• Escalate validated or complex incidents to SOC L2 with complete and accurate documentation of findings and actions taken.
• Record all alerts, investigations, and response actions in the case management/ticketing system.
• Perform routine health checks on security monitoring tools and report gaps in log sources or detection coverage.
• Triage phishing reports and user-reported security concerns, executing first-response steps per playbook.
• Execute containment actions as directed by SOC L2 or the incident lead during active incidents.
• Contribute tuning recommendations to reduce false positives and improve alert quality.
• Maintain complete shift-handover logs to ensure continuity of monitoring between shifts.

Skills

Networking basics

Windows OS

Linux OS

MITRE ATT&CK familiarity

Incident response basics

24/7 shift readiness

Education

Bachelor’s degree in computer science, information technology, or related field

Tools

Splunk

Microsoft Sentinel

QRadar

Ticketing tools

Job description

• Monitor SIEM dashboards, alerts, and security events across network, endpoint, cloud, and application log sources on a 24/7 shift rotation.
  
• Perform initial triage, classification, and prioritization of security alerts following documented playbooks and runbooks.
  
• Escalate validated or complex incidents to SOC L2 with complete and accurate documentation of findings and actions taken.
  
• Record all alerts, investigations, and response actions in the case management/ticketing system.
  
• Perform routine health checks on security monitoring tools and report gaps in log sources or detection coverage.
  
• Triage phishing reports and user-reported security concerns, executing first-response steps per playbook.
  
• Execute containment actions as directed by SOC L2 or the incident lead during active incidents.
  
• Contribute tuning recommendations to reduce false positives and improve alert quality.
  
• Maintain complete shift-handover logs to ensure continuity of monitoring between shifts.
  

Duties and Responsibilities

• Monitor SIEM dashboards, alerts, and security events across network, endpoint, cloud, and application log sources on a 24/7 shift rotation.
  
• Perform initial triage, classification, and prioritization of security alerts following documented playbooks and runbooks.
  
• Escalate validated or complex incidents to SOC L2 with complete and accurate documentation of findings and actions taken.
  
• Record all alerts, investigations, and response actions in the case management/ticketing system.
  
• Perform routine health checks on security monitoring tools and report gaps in log sources or detection coverage.
  
• Triage phishing reports and user-reported security concerns, executing first-response steps per playbook.
  
• Execute containment actions as directed by SOC L2 or the incident lead during active incidents.
  
• Contribute tuning recommendations to reduce false positives and improve alert quality.
  
• Maintain complete shift-handover logs to ensure continuity of monitoring between shifts.
  

Key Performance Indicators/ Key Success Factors

• Mean time to acknowledge (MTTA) alerts within defined SLAs.
  
• Alert triage accuracy and quality of escalations to SOC L2.
  
• Percentage of alerts and cases handled within SLA.
  
• Completeness and quality of case documentation and shift handovers.
  
• False-positive identification and tuning recommendations submitted.

Requirements

• Education: Bachelor’s degree in computer science, information technology, or a related field, or equivalent practical experience.
  
• Experience: 0–2 years in security operations, IT support, or network/system administration; prior SOC or managed security service experience preferred. Must be willing to work on a 24/7 shift rotation.
  
• Skills & Knowledge: Foundational knowledge of networking (TCP/IP, DNS, HTTP), Windows and Linux operating systems, and common attack techniques (MITRE ATT&CK); familiarity with SIEM platforms (Splunk, Microsoft Sentinel, QRadar, or similar) and ticketing tools.
  
• Certifications (good to have): CompTIA Security+, CompTIA CySA+, or Microsoft SC-200 preferred.