SOC Analyst – Level 2
Summary
Level 2 SOC analyst at a cybersecurity services firm in Makati who investigates escalated incidents, leads response coordination and threat hunting, tunes SIEM/EDR detections, analyzes malware and IOCs, and mentors L1 analysts. Requires 3–5+ years in SOC/cybersecurity with SIEM and EDR/XDR experience.
Salary: ₱35,000 – ₱45,000 per month
Role Purpose
The SOC Analyst Level 2 is responsible for advanced investigation, incident analysis, threat hunting, response coordination, and technical escalation within the SOC.
The L2 Analyst acts as the primary escalation point for L1 Analysts and is responsible for validating complex incidents, determining root cause and scope, recommending or coordinating containment actions, and improving SOC detection capabilities.
Key Responsibilities
1. Advanced Incident Investigation
Perform deep-dive analysis of escalated security incidents.
Correlate events across multiple security technologies and log sources.
Determine attack scope, affected users, systems, and business services.
Analyze attacker behavior and map activities to relevant attack techniques.
2. Incident Response and Coordination
Lead technical investigation of medium and high-severity incidents.
Recommend containment, eradication, and recovery actions.
Coordinate with IT, infrastructure, cloud, application, and client teams.
Support incident communications and provide technical updates.
3. Threat Hunting
Conduct proactive threat hunting using logs, telemetry, IOCs, and behavioral indicators.
Identify suspicious activity not detected by existing security controls.
Develop hypotheses and investigative queries.
4. Detection Engineering
Tune SIEM and security analytics rules.
Reduce false positives while maintaining detection coverage.
Recommend and develop new detection use cases.
Identify gaps in log sources and monitoring coverage.
5. Malware and IOC Analysis
Analyze suspicious files, processes, URLs, domains, IP addresses, and hashes.
Investigate persistence, lateral movement, credential abuse, and suspicious command execution.
Use threat intelligence to validate potential malicious activity.
6. L1 Mentoring and Quality Assurance
Provide guidance and technical support to L1 Analysts.
Review escalated cases for quality and completeness.
Conduct case reviews and knowledge-sharing sessions.
Improve SOC playbooks and investigation procedures.
Required Qualifications
Bachelor's degree in IT, Computer Science, Cybersecurity, or related field, or equivalent experience.
Typically 3–5+ years of cybersecurity, SOC, incident response, security engineering, or threat hunting experience.
Hands-on experience investigating security incidents.
Experience with SIEM and EDR/XDR platforms.
Strong understanding of networking, Windows, Linux, Active Directory, cloud, and identity security.
Experience in a Managed SOC or MSSP environment is highly desirable.