{"id":3063881,"url":"https://alion.io/job/cloudstaff-soc-analyst-hybrid","title":"SOC Analyst | Hybrid","company":{"id":50080,"name":"Cloudstaff","domain":"cloudstaff.com","url":"https://alion.io/company/cloudstaff","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"staffing","is_intermediary":false,"listed_via":null,"ats_vendor":"Career site","truth_index":{"grade":"B","score":80,"open_postings":126,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":20,"computed_at":"2026-10-26T05:57:25Z"}},"role":"Security","role_family":"Security","seniority":null,"employment_type":null,"work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Philippines"],"countries":["PH"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Cloudflare","optional":false},{"name":"Crowdstrike","optional":false},{"name":"DLP","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"SIEM","optional":false}],"status":"live","first_seen_at":"2026-09-03T01:37:25Z","employer_posted_date":"2026-10-22","last_verified_at":"2026-10-26T12:40:14Z","board_verified":true,"closed_at":null,"days_open":53,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":53},"description":"Role Purpose\nThe Security Operations Centre (SOC) Analyst runs the day-to-day security monitoring and alert triage function, working across the Security Information and Event Management (SIEM) platform and the wider technology stack. The role watches the environment spanning Microsoft 365, Microsoft Azure and Amazon Web Services (AWS), triaging alerts, escalating incidents and tracking endpoint and vulnerability signals.\nKey Responsibilities\nMonitor the Microsoft Sentinel Security Information and Event Management (SIEM) platform and triage alerts from Microsoft Entra ID, Microsoft 365, AWS CloudTrail and AWS GuardDuty.\nClassify alert severity, run the incident workflow and escalate confirmed incidents through the escalation matrix.\nTriage Endpoint Detection and Response (EDR) alerts and track endpoint coverage gaps for follow-up.\nTrack vulnerability and patch signals from scanning across Azure and AWS, and follow items through to remediation.\nMaintain accurate triage notes, incident records and shift handover documentation, and take part in tabletop and incident response simulation exercises.\nParallel and Cross-Functional Responsibilities\nSupport the Security Operations Engineer on SIEM alert tuning and refining detection metrics.\nFeed EDR and endpoint health findings to the M365 Engineer for hardening and coverage fixes.\nProvide monitoring input to the vCISO for the monthly cybersecurity reporting and dashboard.\nTechnical Environment\nMicrosoft Sentinel as the primary Security Information and Event Management (SIEM) and vulnerability tracking platform across the environment.\nMicrosoft 365 E3 with Microsoft Defender, Microsoft Intune and Microsoft Entra ID as native telemetry sources.\nCrowdStrike or Microsoft Defender for Endpoint Detection and Response (EDR), the Netskope suite for secure web gateway and Data Loss Prevention (DLP), Cloudflare for Web Application Firewall (WAF) protection and LastPass for password management.\nAmazon Web Services (AWS) and Microsoft Azure\nQualifications\nRequired Skills and Experience\nDemonstrated experience monitoring and triaging alerts in a Security Information and Event Management (SIEM) platform.\nSound understanding of alert severity classification, incident workflow and escalation practice.\nPractical monitoring experience across Amazon Web Services (AWS) and Microsoft Azure cloud environments.\nConfident working with Microsoft 365 E3 and Microsoft Entra ID sign-in and audit signals, plus knowledge of Endpoint Detection and Response (EDR) and vulnerability management concepts.\nStrong written English and clear communication for incident notes, handovers and cross-team collaboration.\nHighly Desirable\nHands-on experience with Microsoft Sentinel and the wider security tooling stack for monitoring and triage.\nFamiliarity with Microsoft Sentinel and Microsoft Defender or CrowdStrike detection and hunting workflows.\nExposure to the Netskope suite and Cloudflare protection services, and understanding of the Essential Eight and Centre for Internet Security (CIS) benchmarks.\nA security certification such as Microsoft Certified: Security Operations Analyst Associate or CompTIA Security+.\nPerks and benefits\nComprehensive health and life insurance on your 16th day of employment, covering 1 free dependent on the 16th day of employment\nUp to 24 leave credits per year\nFlexible leave credits which may be used for vacation, emergency and sick leaves\nSuperb and exciting Mid-Year Parties - with items to give away and cash prizes!\nEndless opportunities for career advancement\nExclusive ATM inside the office for employee's convenience\nAnnual Performance Review with Salary Increase\nWe set you up for success with a company-provided PC/Laptop and fiber internet connection\nLook forward to weekly office perks for work from office staff - Free Coffee, Meals and Beer Fridays!\nTop notch workplace with first class VIP lounge and game rooms\nChild friendly spaces to cater to the needs of employees with children, enhancing work-life balance\nParticipate and join our CS Social Clubs and Special Interest Groups to connect with colleagues\nInternational career growth and connections\nUnlimited cash incentives for hired referrals\nMental Wellness Employee Assistance program through Lifeworks\nIn-house psychiatrist available to support employees' well-being\nBecome part of the Employee Share Units program\nCloudstaff Dream Points - To be used for bidding useful items like appliances, kitchenettes etc.","description_format":"text","description_chars":4472,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"English","level":"All levels","optional":false}]},"benefits":["Life insurance"],"hiring_locations":[{"name":"Philippines","iso":"PH","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response"],"lifecycle":[{"event":"open","at":"2026-10-22T07:16:33Z"}],"visa":[],"liveness":{"score":6,"band":"cold","label":"Long shot","p_open":1,"p_active":0.214,"p_room":0.28,"age_days":53,"expected_fill_days":20,"reasons":["conf:1","stale_co","velocity","win:tail","crowd:brand"],"computed_at":"2026-10-26T05:57:25Z"},"pay":null,"html_url":"https://alion.io/job/cloudstaff-soc-analyst-hybrid","json_url":"https://alion.io/job/cloudstaff-soc-analyst-hybrid.json","meta":{"generated_at":"2026-10-26T14:12:42Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":19567,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-27T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":50080},"rest":"https://alion.io/mcp/rest/get_company?id=50080"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fcloudstaff-soc-analyst-hybrid"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fcloudstaff-soc-analyst-hybrid"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fcloudstaff-soc-analyst-hybrid"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/cloudstaff-soc-analyst-hybrid\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fcloudstaff-soc-analyst-hybrid"}]}