SOC Analyst

This is a fully remote position, open to applicants in Philippines.

📋 Description

• Oversee security alerts generated by SIEM, EDR, and cloud platforms.

• Conduct initial triage and categorize alerts as either true or false positives.

• Investigate suspicious activities across endpoints, user identities, and cloud environments.

• Escalate verified incidents to Tier 2 / Incident Response teams with the necessary context.

• Analyze logs from various sources, including CloudTrail, Azure Activity Logs, OS logs, and other pertinent security data sources.

• Clearly document findings in tickets and investigation reports.

• Adhere to existing playbooks while contributing to the enhancement of detection logic over time.

• Effectively communicate with internal teams and clients regarding alerts, findings, and escalations.

⛳️ Requirements

• Minimum of 1 year of experience in Security Operations Center (SOC) or Security Operations.

• Practical experience with EDR tools such as CrowdStrike, SentinelOne, or Microsoft Defender for Endpoint.

• Familiarity with SIEM platforms, including Splunk, Microsoft Sentinel, QRadar, or similar technologies.

• Basic understanding of networking principles, including IP, DNS, HTTP/S, ports, and related concepts.

• Fundamental knowledge of Linux and Windows operating systems.

• Proficient in analyzing logs and identifying suspicious activities.

• Fluent in English, both written and spoken — a requirement.

• Excellent verbal communication skills, particularly in client-facing scenarios.

• Experience with cloud environments such as AWS, Azure, or GCP.

• Knowledge of Google Cloud Platform (GCP) — a significant advantage.

• Capability to investigate cloud activity, including IAM, API calls, and resource changes.

• Understanding of identity-based attacks, including token abuse and privilege escalation.

• Proficient in scripting with Python or Bash.

🏝️ Benefits

• Opportunity for remote work.

• Full-time employment.