SOC Analyst (Tier 2)

📍 Location: Philippines (Fully Remote)
💼 Employment Type: Contract
🕒 Work Schedule: Rotational Shifts | 24/7 Operations
🗣️ Language Requirement: Fluent English for Client Communications

About the Role

We are seeking an experienced Tier 2 Security Operations Center (SOC) Analyst to conduct in-depth security investigations, respond to escalated incidents, and support threat detection and mitigation across cloud and on-premises environments. The ideal candidate has hands-on experience in security operations or incident response, strong log analysis and threat-hunting capabilities, and a solid understanding of attacker tactics, techniques, and procedures.

This role requires a proactive, analytical professional who can investigate complex security events, perform incident response activities, improve detection capabilities, and support Tier 1 analysts in a fast-paced, 24/7 security operations environment.

Key Responsibilities

• Conduct deep-dive analysis and root-cause investigation on escalated alerts.
• Perform containment, eradication, and recovery during active incidents.
• Fine-tune SIEM/EDR rules, update playbooks, and conduct threat hunting.
• Analyze raw Windows, PowerShell, Active Directory, and PCAP logs.
• Mentor Tier 1 analysts and assist in Post-Incident Reviews (PIRs).

Qualifications and Requirements

• At least 1 year of experience in a Security Operations Center (SOC), or incident response
• Strong understanding of cybersecurity threats, attack techniques, incident investigation, and incident response procedures.
• Core Skills: MITRE ATT&CK framework mapping, query writing (KQL, SPL, or Lucene).
• Technical Depth: Raw log analysis (Windows Events, PowerShell, AD telemetry, PCAP) and scripting (Python, PowerShell, or Bash).
• Experience working with SIEM and EDR/XDR platforms for threat detection, investigation, and response.
• Strong analytical, troubleshooting, documentation, and problem-solving skills.
• Excellent written and verbal English communication skills for client coordination, incident reporting, and technical discussions.
• Willingness to work rotational shifts in a 24/7 security operations environment.

Preferred Certifications:

• GIAC Certified Incident Handler (GCIH)
• Certified CyberDefender (CCD)
• Blue Team Level 1 (BTL1) or Blue Team Level 2 (BTL2)
• Microsoft Certified: Security Operations Analyst Associate (SC-200)