SOC Team Lead L2

Accenture in the Philippines; Philippines; Hybrid; PHP 900,000 - 1,500,000; Full time

Job summary

Accenture in the Philippines is seeking a SOC Team Lead (L2) to lead investigation and resolution of complex security incidents and coordinate cross-functional response efforts. You will mentor analysts, drive improvements in detection and playbooks, and ensure thorough incident documentation.

The role emphasizes hands-on incident investigation using SIEM tools, threat hunting, and collaboration with CSIRT and engineering teams, with a hybrid work setup in Cubao.

Qualifications

• 3–5+ years' SOC/Incident Response experience.
• Experience leading or mentoring SOC analysts.
• Hands-on incident investigation using SIEM/security monitoring tools.
• Knowledge of network security, detection, malware analysis, incident response, and threat hunting.
• Experience analyzing logs, traffic, and events across enterprises.
• Ability to coordinate cross-functional responses during high-priority incidents.

Responsibilities

• Lead the investigation and resolution of complex security incidents escalated by L1 analysts.
• Perform root cause analysis, threat validation, and incident triage.
• Act as a key responder during high-severity incidents, coordinating with CSIRT, engineering teams, and stakeholders.
• Conduct threat hunting activities using IoCs and threat intelligence.
• Mentor and guide SOC analysts through coaching, quality reviews, and incident handling best practices.
• Collaborate with detection engineering teams to improve use cases, alert quality, and SOC processes.
• Maintain incident documentation, reports, playbooks, and operational procedures.

Skills

SOC

Incident Response

Cyber Defense

Team Leadership

Threat Hunting

Log Analysis

Crisis Management

Python

PowerShell

Education

Security+

CEH

GCIH

GCIA

Tools

CrowdStrike Falcon

Splunk

Microsoft Sentinel

QRadar

Google SecOps

Job description

Job Description:

Lead Incident Response. Strengthen Cyber Defense.

Join Accenture's Cybersecurity team as a SOC Team Lead (L2) and play a key role in detecting, investigating, and responding to advanced security threats. This role is ideal for experienced SOC professionals who enjoy leading analysts, driving incident response efforts, and continuously improving security operations.

What You'll Do

• Lead the investigation and resolution of complex security incidents escalated by L1 analysts.
• Perform root cause analysis, threat validation, and incident triage across enterprise environments.
• Act as a key responder during high-severity incidents, coordinating with CSIRT, engineering teams, and stakeholders.
• Conduct threat hunting activities using indicators of compromise (IoCs) and threat intelligence.
• Mentor and guide SOC analysts through coaching, quality reviews, and incident handling best practices.
• Collaborate with detection engineering teams to improve use cases, alert quality, and SOC processes.
• Maintain incident documentation, reports, playbooks, and operational procedures.

What We're Looking For

• 3–5+ years of experience in a SOC, Incident Response, or Cyber Defense environment.
• Previous experience leading, mentoring, or supervising SOC analysts is highly preferred.
• Strong hands‑on experience investigating security incidents using SIEM and security monitoring tools.
• Knowledge of network security, threat detection, malware analysis, incident response, and threat hunting.
• Experience analyzing logs, network traffic, and security events across enterprise environments.
• Ability to work effectively during high‑priority security incidents and coordinate cross‑functional response efforts.

Preferred Qualifications

• Experience with CrowdStrike Falcon (highly preferred).
• Hands‑on experience with SIEM platforms such as Splunk, Sentinel, QRadar, Google SecOps, or similar.
• Scripting experience using Python or PowerShell for automation and investigations.
• Certifications such as Security+, CEH, GCIH, GCIA, or similar.
• Exposure to cloud security monitoring across AWS, Azure, or GCP.

Work Setup

• Hybrid work arrangement
• Cubao office location
• Amenable to possible shifting schedules

Why Join Accenture?

At Accenture, you'll work on impactful projects using emerging technologies while collaborating with some of the industry's top cybersecurity professionals.

Benefits & Perks

• Competitive salary package
• Performance bonus and 13th Month Pay
• Day 1 HMO and Life Insurance coverage
• Flexible working arrangements*
• Company-sponsored training, upskilling, and certifications
• Expanded maternity and paternity benefits*
• Employee Stock Purchase Plan
• Inclusive and collaborative work culture
• Terms and conditions apply.

Be Part of an Inclusive Workplace

At Accenture, we celebrate diversity and are committed to creating an inclusive environment where everyone can thrive. We welcome applications from all qualified candidates and provide reasonable accommodations throughout the recruitment process.

Requirements