SOC L2 Cyber Defense Lead - Incident Response

WTW; Taguig; On-site; PHP 1,200,000 - 1,600,000; Full time

Job summary

WTW is seeking a L2 Security Operations Centre analyst to monitor, triage, and investigate security incidents. You will work across a 24/7 SOC with emphasis on rapid detection and containment, reporting, and knowledge sharing.

You will mentor L1 analysts, escalate incidents, and improve alerts and processes to strengthen our security posture. Strong communication, teamwork, and technical skills are essential.

Qualifications

• Works as part of a 24/7 SOC across multiple locations.
• 4-5 years’ experience in a mature cyber defence or SOC.
• Able to troubleshoot security issues and communicate clearly with stakeholders.
• Manage time and complete tasks/incidents within shift.
• Hands-on use of SIEM, UEBA and EDR as a security analyst.

Responsibilities

• Perform investigations on security incidents and analysis of threats.
• Ensure timely response to incidents to minimize business impact.
• Act as escalation point for L1 incidents and coordinate with L3 and other teams.
• Escalate high/critical incidents according to process.
• Safely preserve integrity of security data for incident analysis.
• Provide guidance to L1 analysts and lead shift workload.

Skills

Teamwork

Communication

Calm under pressure

Mentorship

Analytical thinking

Tools

SIEM

UEBA

EDR

Linux

Windows

MacOS

Job description

WTW is seeking a L2 Security Operations Centre analyst to monitor, triage, and investigate security incidents. You will work across a 24/7 SOC with emphasis on rapid detection and containment, reporting, and knowledge sharing.

You will mentor L1 analysts, escalate incidents, and improve alerts and processes to strengthen our security posture. Strong communication, teamwork, and technical skills are essential.