Security Operations

• Independently execute and support day-to-day security operations
• Monitor and triage security alerts and investigate suspected security events
• Assess scope, impact, priority, and appropriate next steps
• Document alert dispositions, findings, decisions, and actions
• Escalate confirmed or suspected security events with relevant context
• Coordinate approved containment, recovery, and follow-up activities during defined working hours
• Execute recurring security and compliance reviews across assigned controls and frameworks
• Collect, review, organize, and maintain supporting evidence
• Identify control gaps, missing evidence, control drift, or potential findings
• Track findings and remediation commitments through completion or escalation
• Maintain security plans, compliance records, assessment artifacts, and documentation
• Perform vulnerability, endpoint, configuration, backup, access, and security-tool reviews
• Review vulnerability findings and verify remediation status
• Evaluate access, authentication, permissions, shared/service accounts, and least-privilege controls
• Conduct or support security risk assessments for systems, applications, vendors, projects, integrations, and material changes
• Maintain risk and remediation records and follow up on open items
• Create and maintain security procedures, runbooks, checklists, assessment tools, and triage guidance
• Keep documentation aligned with current systems and processes
• Design, configure, execute, and evaluate approved phishing simulations and security testing
• Identify gaps and recommend practical improvements
• Collaborate with IT, Engineering, and other internal teams on security activities, findings, remediation, and user-facing security needs

SOC Analyst Level 2

• Monitor alerts across EDR, firewall, IPS, WAF, and SIEM platforms in real time
• Triage alerts, prioritize severity, and distinguish true positives under time pressure
• Maintain continuous 24x7 threat monitoring through rotating shifts, including nights, weekends, and holidays
• Conduct deep incident investigations across EDR, network, and cloud log sources
• Determine incident root cause, scope, and indicators of compromise
• Provide incident analysis and containment recommendations to client teams that own response execution
• Tune SIEM correlation rules and detection logic to reduce false positives and close security coverage gaps
• Document investigation findings and incident timelines in case management systems
• Update SOC playbooks and standard operating runbooks
• Partner with GRC engineers and vCISOs to align threat detection with client compliance obligations
• Execute investigation handoffs across shift rotations
• Guide junior analysts on investigative techniques
• Partner directly with client stakeholders to maintain detection coverage around the clock

Security Operations Analyst

• Implement and verify technical controls across the cardholder data environment, including access management, secure configuration, logging and monitoring, vulnerability management, encryption and key management, and secure development practices.
• Implement PCI DSS v4.0.1 logging and monitoring requirements, including centralised audit-log collection, log protection, retention, automated log review, time synchronisation, critical-file change detection, and failure alerting.
• Work alongside the client's DevOps engineer on rollout of Wazuh, owning compliance outcomes, required log-source coverage, detection and correlation rules, file-integrity monitoring, retention, validation, and evidence.
• Define the alert triage and response routine for the client team.
• Complete SAQ D for Service Providers and assemble supporting evidence.
• Maintain network and cardholder dataflow diagrams, scoping and segmentation documentation, policies, and operating procedures.
• Engage and manage an Approved Scanning Vendor for quarterly external vulnerability scanning and drive remediation to passing scans.
• Scope and coordinate penetration testing with a qualified independent provider; manage remediation and retesting.
• Maintain third-party service-provider due diligence, including partner AOC collection and shared-responsibility documentation.
• Own the delivery plan, schedule, dependencies, risk log, and weekly leadership reporting.
• Strengthen change-management practices so changes are raised, approved, tested, and evidenced consistently.
• Document repeatable operational routines for the client team after the engagement ends.
• Run the annual PCI DSS compliance cycle to completion during a three-month contract and prepare the Attestation of Compliance for executive sign-off.

Security Operations jobs in Philippines

SOC Analyst Level 2

Security Operations Analyst

Security Operations Engineer – PCI DSS