ACTIVE : SOC TEAM LEAD (L2) - SIEM PLATFORM OPERATION | CUBAO

Location: Hybrid | Cubao
⏰ Schedule: Shifting Schedule
Salary: Confidential (Competitive, based on client and project assignment)
Start Date: ASAP
Experience: 3–5+ Years in SOC / Incident Response
Headcount: 1

---

The Role

Are you a SOC Leader with deep expertise in SIEM operations and incident response? Do you thrive on leading investigations, mentoring analysts, and strengthening cyber defense strategies?

We are looking for a high-caliber SOC Team Lead (L2) to lead incident response efforts, investigate and resolve complex security incidents, and continuously improve security operations. You will act as a key responder during high-severity incidents, coordinate with cross-functional teams, and mentor SOC analysts through coaching and quality reviews.

If you have 3–5+ years of experience in a SOC, Incident Response, or Cyber Defense environment, hands-on experience with SIEM platforms, and a passion for threat hunting and detection, we want to hear from you!

---

Key Responsibilities

· Incident Response: Lead the investigation and resolution of complex security incidents escalated by L1 analysts.
· Threat Analysis: Perform root cause analysis, threat validation, and incident triage across enterprise environments.
· High-Severity Response: Act as a key responder during high-severity incidents, coordinating with CSIRT, engineering teams, and stakeholders.
· Threat Hunting: Conduct threat hunting activities using indicators of compromise (IoCs) and threat intelligence.
· Team Leadership: Mentor and guide SOC analysts through coaching, quality reviews, and incident handling best practices.
· Process Improvement: Collaborate with detection engineering teams to improve use cases, alert quality, and SOC processes.
· Documentation: Maintain incident documentation, reports, playbooks, and operational procedures.

---

Minimum Qualifications

· Experience: 3–5+ years of experience in a SOC, Incident Response, or Cyber Defense environment.
· Leadership: Previous experience leading, mentoring, or supervising SOC analysts is highly preferred.
· Technical Skills:
· Strong hands-on experience investigating security incidents using SIEM and security monitoring tools.
· Knowledge of network security, threat detection, malware analysis, incident response, and threat hunting.
· Experience analyzing logs, network traffic, and security events across enterprise environments.
· Preferred Skills:
· Experience with CrowdStrike Falcon (highly preferred).
· Hands-on experience with SIEM platforms such as Splunk, Sentinel, QRadar, Google SecOps, or similar.
· Scripting experience using Python or PowerShell for automation and investigations.
· Certifications such as Security+, CEH, GCIH, GCIA, or similar.
· Exposure to cloud security monitoring across AWS, Azure, or GCP.
· Soft Skills: Ability to work effectively during high-priority security incidents and coordinate cross-functional response efforts.
· Work Setup: Willing to work hybrid in Cubao with a shifting schedule.
· Eligibility: Open to applicants currently in the Philippines with the right to live and work in the country.