SOC L3 Specialist

Trends Group, Inc.; Makati; On-site; PHP 900,000 - 1,300,000; Full time

Job summary

Trends Group, Inc. is seeking an experienced SOC/NOC professional to join our service operations team in Makati. You will monitor security events, manage incidents, and support continuous service availability across client environments.

The role requires a Bachelor’s degree in IT, 4+ years in SOC/NOC, and strong knowledge of SIEM/SOAR platforms, networking concepts, and risk assessment. On-site work in Makati with opportunities for career growth and certifications.

Qualifications

• Bachelor's degree in an IT-related field is required.
• At least four years of SOC/NOC experience in 24x7 operations.
• Familiarity with IT service management and cybersecurity concepts.

Responsibilities

• Triage and respond to security events and incidents according to procedures.
• Maintain and update playbooks, runbooks, and incident reports.
• Monitor service availability, capacity, and performance metrics.
• Coordinate with teams to ensure SLAs and client expectations are met.
• Support business continuity and disaster recovery activities.

Skills

SOC operations

Incident management

Networking concepts

Risk assessment

Education

Bachelor's degree in IT-related field

Tools

SIEM platforms

SOAR platforms

Job description

I. PURPOSE

To support and participate in initiatives that enhance existing service operations and effectively implement the service portfolio, with the goal of achieving service excellence, improving operational efficiency, and strengthening customer retention.

II. DUTIES AND RESPONSIBILITIES

A. General Responsibilities

• Complete all tasks assigned by the Shift Manager promptly and effectively to support organizational objectives.
• Follow established processes and procedures, ensuring compliance with escalation protocols.
• Report significant events and incidents to the Shift Manager and actively participate in shift handovers.
• Contribute to the development and maintenance of knowledge and information relevant to Service Operations.
• Collaborate with team members to improve workflows, documentation, standards, and operational processes.
• Promote a positive and harmonious working environment through mutual trust, respect, and open communication.
• Comply with all company policies, guidelines, standards, and procedures.
• Perform other duties and responsibilities as assigned by the Shift Manager and MSS Manager.

B. Availability Management

• Manage daily shift schedules and leave arrangements, develop operational procedures, and coordinate team training to maintain the required availability of personnel and processes for Service Operations delivery.
• Monitor daily performance metrics and ensure compliance with management-defined operational targets.
• Ensure that appropriate tools and systems are available to support agreed service availability targets, including access request management, error and incident reporting, and escalation processes.

C. Capacity Management

• Assess and monitor the capacity and performance of personnel, processes, and organizational controls to identify operational gaps and address issues through appropriate adjustments to workflows, tools, and resource allocation.
• Implement strategies developed by management to support service delivery and meet short-, medium-, and long-term business requirements.

D. IT Service Continuity Management

• Perform assigned responsibilities under the Business Continuity Plan (BCP).
• Lead and coordinate team participation in BCP activities to maintain operational continuity and ensure that minimum agreed service levels are sustained during disruptive incidents.

E. Risk Management

- Participate in the implementation of risk treatment plans addressing risks to the personnel, processes, and operations supporting Service Operations that may affect clients, Sales Groups, and other relevant stakeholders.

F. Service Level Management

• Ensure compliance with client Service Level Agreements (SLAs).
• Oversee and manage the performance of Internal Support team members.
• Monitor, evaluate, and report operational service-level performance against established targets.

G. Change Advisory Board (CAB)

• Review Methods of Procedure (MOPs) for presentation during Managed ICT Services Change Advisory Board meetings.
• Participate in client Change Advisory Board meetings as required.
• Prepare advisories outlining the potential impacts, risks, and consequences of proposed client changes.
• Prepare and provide MOPs and other relevant documentation to clients when necessary.

H. Configuration Management

• Collect, validate, and maintain accurate configuration information for client assets throughout Service Operations.
• Maintain up-to-date records of client Configuration Items (CIs).
• Ensure that a logical configuration model is maintained, documenting the components of client CIs and their relationships.
• Facilitate the handover of configuration items and related information to the Service Transition team during client offboarding.

I. Client Support

• Ensure that team members effectively perform the following responsibilities:
• Triage incoming events and incidents to determine their severity, priority, and required actions.
• Manage and resolve cases assigned to them in accordance with established procedures.
• Conduct brand monitoring and process takedown requests.
• Fulfill Service Requests within agreed SLAs.
• Take immediate action to restore failed services for Managed Service clients.
• Manage escalations and conduct follow-ups until resolution.
• Prepare Incident Reports and Root Cause Analysis (RCA) reports as required.
• Implement established frameworks, guidelines, and procedures aligned with industry best practices for Event Management, Incident Management, and Service Request Management.

J. Client Incident Management

• Develop and maintain operational playbooks for detecting, analyzing, containing, eradicating, remediating, and recovering from client cybersecurity incidents and service quality issues.
• Lead the investigation and resolution of Priority 2 (P2) escalations.
• Lead the initial triage and resolution efforts for Priority 1 (P1) incidents.
• Escalate incidents that may develop into major problems or disasters.
• Prepare RCA reports and conduct Compromise Assessment and Preventive Action (CA/PA) activities to identify root causes, assess potential compromise, and prevent recurrence.

K. Client Access Management

• Ensure that team members properly manage user access authorization to client assets, granting access only to authorized users and preventing unauthorized access.
• Ensure that access management activities comply with the client's terms and conditions, policies, and security requirements.

L. Client IT Asset Management

• Ensure that all client-managed IT assets are properly accounted for, maintained, and upgraded when included within the service scope.
• Monitor the lifecycle of client-managed assets and provide relevant reports, assessments, and recommendations to clients, Service Delivery Managers, and other stakeholders.

M. Client Problem Management

• Provide the necessary information and supporting data to facilitate problem investigation and ensure the implementation of Compromise Assessment and Preventive Action (CA/PA) measures.
• Ensure that the team complies with contractual obligations and established requirements for Problem Management deliverables.

N. Process Management

• Develop, document, communicate, maintain, and manage Service Operations processes.
• Ensure that established processes are consistently followed and implemented across the team.

O. Knowledge Management

• Maintain and update knowledge repositories and operational documentation relating to existing clients and their Managed ICT assets.
• Ensure that relevant operational knowledge and information remain accurate, current, and accessible to authorized personnel.

P. Continual Service Improvement Management

• Implement improvement initiatives and action plans focused on enhancing personnel performance and Service Operations processes.
• Recommend, develop, and implement new or improved processes, and ensure team compliance with the updated procedures.
• Review and ensure the accuracy, completeness, and quality of ticket information and documentation.

III. QUALIFICATIONS

A. Minimum Educational Requirements

- Bachelor's degree in an IT-related field, such as:

• Computer Studies
• Computer Engineering
• Information Technology
• Electronics Engineering

B. Minimum Experience and Training Requirements

• At least four (4) years of relevant work experience in a 24x7x365 Security Operations Center (SOC) or Network Operations Center (NOC).
• Relevant training and/or certifications in at least one or more of the following areas:
• IT Service Management
• IT Infrastructure, including networking, servers, and cloud technologies
• Cybersecurity and/or Information Security

C. Competency Requirements

The following proficiency levels apply:

• F – Familiar: 0–12 months of experience
• N – Novice: 1–2 years of experience
• I – Intermediate: 3–4 years of experience
• A – Advanced: More than 5 years of experience

1. Knowledge

• Intermediate: Knowledge of cybersecurity and privacy principles.
• Intermediate: Understanding of computer networking concepts, protocols, and network security methodologies.
• Intermediate: Knowledge of risk management processes, including risk assessment and mitigation techniques.
• Intermediate: Understanding of cyber threats, vulnerabilities, and associated security risks.
• Intermediate: Knowledge of the operational impacts of cybersecurity incidents and security control failures.
• Intermediate: Understanding of network security architecture, including network topology, protocols, components, and defense-in-depth principles.
• Intermediate: Knowledge of system administration and network and operating system hardening techniques.
• Novice: Familiarity with the MITRE ATT&CK Framework and NIST Special Publication 800-61.

2. Skills

• Novice: Ability to operate Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) platforms. Experience with Splunk or McAfee SIEM, and Swimlane or Siemplify SOAR, is an advantage.
• Intermediate: Ability to identify, capture, contain, and report malware‑related threats and activities.
• Intermediate: Ability to develop and document incident response procedures.

3. Abilities

• Novice: Ability to apply SOAR playbooks and SIEM correlation rules to investigate host‑based and network‑based intrusions.

4. Communication Skills

• Novice: Communicates clearly and effectively, ensuring that information is easily understood.
• Novice: Presents ideas and information in a logical, organized, and structured manner.
• Novice: Produces clear, concise, and effective written communications.
• Novice: Organizes written information logically to ensure accuracy, clarity, and ease of understanding.