KPMG Philippines

SOC / Security Analyst – L1 | L2 | L3 – Talent Pool
Job Description
KPMG Philippines is building a talent pool of
SOC / Cybersecurity professionals
for current and future opportunities within our Cybersecurity practice.
We are looking for professionals across
Security Operations Center (SOC) L1, L2, and L3 levels
with experience in security monitoring, incident detection and response, threat analysis, investigation, and cybersecurity operations.
The level and opportunity will be aligned with the candidate's
technical expertise, relevant experience, and overall qualifications
.
Roles and Responsibilities:
SOC L1 – Security Analyst
The SOC L1 Analyst is responsible for the detailed and repeatable execution of SOC operational activities and established procedures.
Key responsibilities include:
<ul>
<li>Monitor SIEM and security monitoring tools for security events and alerts.</li>
<li>Perform initial alert triage and analysis.</li>
<li>Close or escalate security events based on established procedures.</li>
<li>Assist the MDR team with incident detection, investigation, and remediation.</li>
<li>Support incident workflows and communicate with relevant internal and external teams.</li>
<li>Maintain accurate tickets, shift logs, incident documentation, and operational records.</li>
<li>Monitor and maintain SOC communication channels and distribution lists.</li>
<li>Escalate suspicious or potentially critical events to L2/L3 analysts.</li>
</ul>
SOC L2 – Senior Security Analyst
The SOC L2 Analyst is responsible for handling more complex security events and incidents while ensuring proper execution and documentation of SOC procedures.
Key responsibilities include:
<ul>
<li>Perform advanced analysis and investigation of security alerts and incidents.</li>
<li>Ensure incidents are detected, tracked, documented, and escalated appropriately.</li>
<li>Determine appropriate escalation of events outside the SOC.</li>
<li>Assist with incident detection, response, remediation, and resolution.</li>
<li>Support continuous improvement of SOC procedures and operational processes.</li>
<li>Provide technical guidance and mentorship to L1 analysts.</li>
<li>Review incident documentation and ensure adherence to established procedures.</li>
<li>Communicate with technical teams and other stakeholders during incident resolution.</li>
<li>Support SOC metrics, reporting, and process improvement initiatives.</li>
</ul>
SOC L3 – Senior / Lead Security Analyst
The SOC L3 Analyst serves as a subject matter expert responsible for advanced incident investigation, threat analysis, and escalated security events.
Key responsibilities include:
<ul>
<li>Lead the investigation and response of escalated and critical security incidents.</li>
<li>Perform advanced threat analysis, incident investigation, and root-cause analysis.</li>
<li>Analyze malware, attack vectors, network communications, and potential vulnerabilities.</li>
<li>Conduct advanced analysis of security events across network, endpoint, and SIEM technologies.</li>
<li>Support threat hunting, malware analysis, and cyber-forensic activities.</li>
<li>Develop technical after-action reports, lessons learned, and remediation recommendations.</li>
<li>Identify opportunities to enhance detection capabilities, tools, and SOC processes.</li>
<li>Provide technical recommendations to the SOC Manager and Information Security/IT leadership.</li>
<li>Serve as a subject matter expert for complex cybersecurity incidents.</li>
<li>Support the development and maintenance of security tools, techniques, and detection methodologies.</li>
</ul>
Required Technical Skills
Depending on the level, experience with the following technologies and cybersecurity domains is highly desirable:
<ul>
<li>SOC / MDR operations</li>
<li>Security monitoring and incident response</li>
<li>SIEM platforms such as
Microsoft Sentinel, Splunk, LogRhythm
, or equivalent</li>
<li>Microsoft / Azure Sentinel</li>
<li>EDR/XDR and security monitoring technologies</li>
<li>IDS/IPS and firewall technologies such as
Snort, Cisco, Fortigate, Sourcefire</li>
<li>Windows and Unix/Linux operating systems</li>
<li>Network security devices and architectures</li>
<li>LAN/WAN technologies</li>
<li>TCP/IP and networking protocols</li>
<li>OSI Seven-Layer Model</li>
<li>Packet analysis and packet capture tools</li>
<li>Incident detection, investigation, and response</li>
<li>Threat hunting and malware analysis</li>
<li>Cyber forensics</li>
<li>Vulnerability assessment and penetration testing</li>
<li>Tools such as
Nmap, Metasploit, Kali Linux
, and vulnerability scanners</li>
<li>Scripting/programming using
PowerShell, Bash, Python
, or similar technologies</li>
<li>ITSM and ticketing tools</li>
</ul>
Qualifications
<ul>
<li>Bachelor's degree in
Computer Science, Information Technology, Cybersecurity, Engineering
, or a related field.</li>
<li>Atleast 1 year to 5+ years relevant experience in
SOC, MDR, Information Security, Cybersecurity, Incident Response, Network Security, or System Administration
.</li>
<li>Experience in incident detection and response, threat analysis, malware analysis, or cyber forensics is an advantage.</li>
<li>Strong understanding of network security, networking protocols, security technologies, and cybersecurity best practices.</li>
<li>Strong analytical and problem-solving skills.</li>
<li>Excellent written and verbal communication skills.</li>
<li>Ability to work effectively in a fast-paced and client-focused environment.</li>
<li>Ability to work collaboratively with technical teams and stakeholders.</li>
<li>Willingness to work on shifting schedules, including
nights, weekends, and holidays
, when required for SOC operations or incident response.</li>
<li>Ability to adapt to different engagement requirements, working environments, and client needs.</li>
</ul>
Preferred Certifications
Relevant cybersecurity certifications are an advantage, including:
<ul>
<li>CompTIA Security+</li>
<li>CompTIA Network+</li>
<li>Certified Ethical Hacker (CEH)</li>
<li>Certified Information Systems Security Professional (CISSP)</li>
<li>GIAC Certified Intrusion Analyst (GCIA)</li>
<li>GIAC Certified Incident Handler (GCIH)</li>
<li>GIAC Reverse Engineering Malware (GREM)</li>
</ul>
Career Level -
SOC L1 | SOC L2 | SOC L3
Candidates will be evaluated and aligned to the appropriate level based on their
relevant SOC/MDR experience, technical capabilities, cybersecurity knowledge, and overall qualifications
.
Join KPMG Philippines
At KPMG, you will have the opportunity to work with professionals and clients across different industries while developing your expertise in
cybersecurity, security operations, incident response, and emerging security technologies
.
If you are a cybersecurity professional interested in exploring opportunities with KPMG Philippines, we encourage you to submit your profile and join our
SOC/MDR talent pool
.
Apply now and indicate your preferred level: SOC L1, SOC L2, or SOC L3.

SOC / Security Analyst – L1 | L2 | L3 – Talent Pool

SOC / Security Analyst – L1 | L2 | L3 – Talent Pool

This job is no longer available

Talents

Recruiters

About