SOC Team Lead (L2)

Location: Cubao, Philippines
Work Setup: Hybrid
Work Shift: Shifting
Salary: Confidential – To be discussed during the Job Offer

Job Overview

We are looking for an experienced SOC Team Lead (L2) to join our Cybersecurity team. The role will be responsible for leading security incident investigations, supporting advanced threat detection and response, mentoring SOC analysts, and strengthening overall security operations.

Key Responsibilities

• Lead the investigation and resolution of complex security incidents escalated by L1 analysts.

• Perform root cause analysis, threat validation, and incident triage across enterprise environments.

• Act as a key responder during high-severity security incidents.

• Coordinate with CSIRT, engineering teams, and other stakeholders during incident response.

• Conduct threat hunting using Indicators of Compromise (IoCs) and threat intelligence.

• Mentor, coach, and guide SOC analysts on incident handling and security best practices.

• Conduct quality reviews and help improve SOC operational processes.

• Collaborate with detection engineering teams to improve security use cases and alert quality.

• Maintain incident documentation, reports, playbooks, and operational procedures.

Requirements

• 3–5+ years of experience in SOC, Incident Response, or Cyber Defense environments.

• Previous experience leading, mentoring, supervising, or guiding SOC analysts is highly preferred.

• Strong hands-on experience with SIEM and security monitoring tools.

• Knowledge of network security, threat detection, malware analysis, incident response, and threat hunting.

• Experience analyzing logs, network traffic, and security events in enterprise environments.

• Ability to handle high-priority security incidents and coordinate cross-functional response activities.

Preferred Qualifications

• Experience with CrowdStrike Falcon.

• Hands-on experience with Splunk, Microsoft Sentinel, QRadar, Google SecOps, or similar SIEM platforms.

• Scripting experience with Python or PowerShell.

• Certifications such as Security+, CEH, GCIH, GCIA, or equivalent.

• Exposure to cloud security monitoring across AWS, Azure, or GCP.

Work Setup

• Hybrid work arrangement.

• Cubao office location.

• Willingness to work on shifting schedules.

• Applicants must currently be in the Philippines and have the legal right to live and work in the country.

Recruitment Process

• Initial screening with CV Reviewer.

• Validation and further CV screening through Workday, including the HRI toolkit, FCV, and CV.

• Final review with the client.

Pre-Screening Questions

1. How many years of experience do you have in a SOC, Incident Response, or Cyber Defense environment?

2. Have you led, mentored, supervised, or guided SOC analysts?

3. What is your level of hands-on experience with SIEM platforms?

4. What is your last drawn salary?

5. What is your expected salary?

6. Are you willing to work in a hybrid setup in Cubao with a shifting schedule?

7. What is your notice period?