We're hiring
SOC Analyst (Splunk ES)
- Pasay City, Metro Manila
- Hybrid/Remote
About the role
As a SOC Analyst, you will monitor security events, investigate incidents, improve detection rules, and work closely with technical teams and clients to strengthen their security posture. This role is suited for someone with strong hands-on experience in Splunk Enterprise Security, incident response, and threat detection.
What you will do
- Monitor, analyze, and investigate security alerts and events within the Security Operations Center.
- Perform incident triage, investigation, containment, remediation coordination, and escalation.
- Develop and optimize complex Splunk SPL searches, dashboards, and correlation rules.
- Fine-tune security alerts to improve detection accuracy and reduce false positives.
- Investigate endpoint security incidents using CrowdStrike Falcon.
- Analyze email security threats using Proofpoint TAP/TRAP or similar platforms.
- Identify emerging threats and recommend proactive security improvements.
- Document investigations, findings, actions taken, and remediation activities.
- Collaborate with Security Engineers, IT teams, and clients during incident response.
- Participate in rotating shifts to support continuous SOC coverage.
What we are looking for
- Three to five years of cybersecurity experience, including at least two years in a Security Operations Center.
- Strong experience in incident response, threat detection, and security event analysis.
- Advanced hands-on experience with Splunk Enterprise Security or Splunk Core.
- Expert-level ability to write and optimize complex Splunk SPL queries.
- Practical experience using CrowdStrike Falcon.
- Experience with Proofpoint TAP/TRAP or a comparable email security platform.
- Working knowledge of MITRE ATT&CK, SIEM technologies, endpoint security, and cybersecurity best practices.
- Strong analytical, troubleshooting, and problem-solving abilities.
- Clear written and verbal communication skills.
- Ability to work independently and collaborate with cross-functional teams.
- Willingness to work rotating or shifting schedules.
PREFERRED QUALIFICATIONS
- Certifications such as CompTIA Security+, CySA+, Splunk Certified, GIAC, CEH, CISSP, or an equivalent credential.
- Experience with SOAR platforms and security automation.
- Exposure to Microsoft Azure, AWS, or Google Cloud security.
- Experience in threat hunting or malware analysis.
READY TO STRENGTHEN OUR CYBER DEFENSE?
If you have deep Splunk expertise and enjoy investigating threats before they become larger incidents, we want to hear from you.