SOC Technical SME: SIEM & Detection Expert (Remote)

Evans & Chambers Technology; Manila; Remote; PHP 1,800,000 - 2,400,000; Full time

Job summary

Evans & Chambers Technology is seeking a Security Operations Center (SOC) Technical SME to join our team in a local remote role with up to 40% travel within NCR. The SOC SME will serve as the technical backbone of a 24/7 operation, focusing on log analysis, SIEM tuning, and detection engineering to keep pace with evolving adversary techniques.

The role requires 7+ years in information security, expertise with SIEMs (Splunk/QRadar/Elastic/Sentinel), and relevant certifications such as CySA+,

Qualifications

• Bachelor's degree in CS, IS, Engineering or related field.
• 7+ years in information security with SIEM, log analysis, and SOC tooling.
• Experience with Splunk, QRadar, Elastic or Sentinel.
• Certifications: CySA+, GCIA, GCIH or CISSP.

Responsibilities

• Analyze logs from network, host, app, cloud, and identity sources for anomalies
• Tune SIEM platforms to improve detection and reduce false positives
• Evaluate log retention and ingestion pipelines for data completeness
• Develop and maintain detection content and correlation rules
• Escalate complex triage to Tier 1/2 analysts
• Use SIEM, EDR, NDR, SOAR and threat intel tools
• Support containment and recovery during incidents
• Report SOC metrics and detection coverage with the SOC PM
• Recommend process improvements and automation
• Stay current on threats and TTPs and apply intel
• Mentor junior SOC analysts
• Collaborate on playbooks and operation effectiveness

Skills

SIEM administration

Log analysis

Threat intelligence

Incident response

Detection engineering

Education

Computer Science degree

CySA+

CISSP

GCIA

Tools

Splunk

QRadar

Elastic

Microsoft Sentinel

Job description

Evans & Chambers Technology is seeking a Security Operations Center (SOC) Technical SME to join our team in a local remote role with up to 40% travel within NCR. The SOC SME will serve as the technical backbone of a 24/7 operation, focusing on log analysis, SIEM tuning, and detection engineering to keep pace with evolving adversary techniques.

The role requires 7+ years in information security, expertise with SIEMs (Splunk/QRadar/Elastic/Sentinel), and relevant certifications such as CySA+,