{"id":4233077,"url":"https://alion.io/job/ey-cyber-detection-response-l3-analyst-2","title":"Cyber Detection & Response - L3 Analyst","company":{"id":2859,"name":"EY","domain":"ey.com","url":"https://alion.io/company/ey-com","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"SuccessFactors","truth_index":null},"role":"Security","role_family":"Security","seniority":"junior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Cebu City, Philippines"],"countries":["PH"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Cortex XSOAR","optional":false},{"name":"Crowdstrike","optional":false},{"name":"GCP","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false}],"status":"live","first_seen_at":"2026-11-13T10:49:17Z","employer_posted_date":"2026-11-13","last_verified_at":"2026-11-13T10:49:17Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"At EY, you’ll have the chance to build a career as unique as you are, with the global scale, support, inclusive culture and technology to become the best version of you. And we’re counting on your unique voice and perspective to help EY become even better, too. Join us and build an exceptional experience for yourself, and a better working world for all.\nService line: Cyber Security - Position Title: Senior Incident Response Analyst\nAt EY, we’re all in to shape your future with confidence.\nWe’ll help you succeed in a globally connected powerhouse of diverse teams and take your career wherever you want it to go.\nJoin EY and help to build a better working world.\nAbout Global Delivery Services\nGlobal Delivery Services refers to EY's worldwide network of service delivery centers. The GDS team plays an important role in EY’s strategy by ensuring effective support to EY’s growth agenda.\nOur journey started in 2002 with approximately 200 people. Today we stand at 80,000+ professionals in ten locations around the world. We operate in Argentina, China, Hungary, India, Philippines, Poland, Sri Lanka, Mexico, Spain and the United Kingdom.\nClient service is focused on providing Consulting, Assurance, Tax, Strategy & Transactions, and Knowledge support to our clients around the world. The teams enable account teams worldwide to provide seamless, high-quality, value-added support, helping deliver exceptional client service.\nEnablement Services provides cost-effective, high-skilled, and innovative services to support EY’s global and local enablement teams. Markets, BMC, AWS, Finance and Accounting, Risk Management, Procurement, People Shared Services, IT Service Delivery and IT Global Infrastructure services, are among the services offered by Enablement Services.\nOur innovation specialists serve the GDS Client Service and Enablement Services teams, along with Service Lines, Core Business Services and Sectors. The team brings the desired environment, technologies and skilled teams together for facilitation, rapid prototyping and innovative thinking. The competencies offered include analytics, digital, user experience, mobile technology, infrastructure, Microsoft technologies and open innovation.\nThe Opportunity\nAs a Senior Incident Response Analyst, you will play a pivotal role in EY’s global cybersecurity operations, leading efforts to detect, investigate, contain, and remediate complex security incidents across cloud, on-premise, and hybrid environments. You will work with cutting-edge technologies and global teams to protect EY’s infrastructure, assets, and data from evolving cyber threats.\nIn this role, you will leverage your technical expertise and analytical skills to perform advanced threat analysis, digital forensics, and root cause investigations. You will guide and mentor junior analysts, enhance detection and response capabilities, and contribute to the continuous improvement of incident response processes and playbooks.\nThis opportunity allows you to be part of a global, high-impact cyber defense team, where you’ll collaborate with leading experts, utilize advanced security tools, and help shape EY’s proactive defense strategy. You’ll play a key role in ensuring organizational resilience, operational readiness, and trust in EY’s digital ecosystem.\nYour Key Responsibilities\nTier 3 Security Incident Response:\nConduct Tier 3 security incident response for application, network, and infrastructure security alert events.\nUtilize documented procedures and in-house security technologies to manage incidents effectively.\nCoordination and Task Assignment:\nAssign containment, eradication, and recovery tasks to appropriate resource teams.\nEnsure clear communication and coordination with relevant teams during incident response activities.\nResponse Actions and Host Management:\nPerform response actions on managed hosts where the Security Operations Center (SOC) team has requisite access and permissions.\nIsolate suspected compromised or infected hosts and execute other pre-approved actions to disrupt cyberattacks.\nIncident Clarification and Communication:\nClarify incident information and recommend containment, eradication, and recovery actions to the cyber defense team.\nParticipate in cyber defense calls related to cybersecurity incidents and provide updates as needed.\nPeer Review and Quality Assurance:\nConduct periodic peer reviews of Tier 2 analyst work to identify trends in effectiveness and areas for improvement.\nProvide constructive feedback to enhance the overall quality of incident response efforts.\nEscalation and Reporting:\nEngage relevant parties for issue escalation and reporting.\nEnsure timely communication of critical incidents and status updates to stakeholders, including executive management.\nCoordination and Best Practices:\nCollaborate with global teams to standardize incident response procedures and share best practices.\nAdapt response strategies to accommodate different regional and regulatory requirements.\nContinuous Improvement and Learning:\nStay updated with the latest cybersecurity threats, trends, and technologies.\nContribute to the development and enhancement of incident response processes and playbooks.\nDocumentation and Analysis:\nMaintain comprehensive documentation of all incidents, actions taken, and lessons learned.\nAnalyze incident data to identify patterns, improve detection capabilities, and prevent future incidents.\n· Responsible for decision-making, optimizing processes, resource management, and overseeing team management as needed for task execution.\n· Accountable for allocating personnel, supervising team members, assigning tasks, ensuring that the team has the necessary tools and support to succeed in their roles and optimizing and evaluating their performance to meet organizational goals.\nSkills and attributes for success\n>\nProven experience in incident response, threat hunting, and digital forensics within enterprise or managed security environments.\nStrong knowledge of cyberattack tactics, techniques, and procedures (TTPs), aligned with frameworks such as MITRE ATT&CK.\nProficiency with SIEM tools (e.g., Splunk, Microsoft Sentinel), EDR platforms (e.g., CrowdStrike, Defender for Endpoint), and SOAR automation frameworks.\nExperience conducting log analysis, packet inspection, and malware triage to identify and mitigate threats.\nExpertise in analyzing incidents involving cloud environments (AWS, Azure, GCP) and hybrid infrastructure.\nFamiliarity with threat intelligence integration, playbook automation, and incident post-mortem reporting.\nStrong understanding of network protocols, operating systems, and security controls.\nAbility to communicate technical findings clearly to both technical and non-technical stakeholders.\nExperience mentoring or guiding junior analysts, fostering knowledge sharing and operational maturity.\nStrong documentation and reporting skills to support compliance, governance, and continuous improvement efforts.\nRelevant professional certifications such as GCIH, GCFA, GCIA, CEH, CISSP, or CCIR will be a strong advantage.\n>\n3-5 years related experience in cybersecurity operations, particularly in a SOC or similar environment.\nProficiency in using security monitoring tools, such as Sentinel SIEM systems, IDS/IPS, EDR - Microsoft Defender, XSOAR - SOAR solutions.\nStrong knowledge of application, network, and infrastructure security.\nExcellent analytical, problem-solving, and decision-making skills.\nAbility to work under pressure and manage multiple incidents simultaneously.\nStrong communication and teamwork skills, with the ability to coordinate with cross-functional teams.\nFamiliarity with global cybersecurity standards and regulatory requirements.\nWhat we offer you\nAt EY, we’ll develop you with future-focused skills and equip you with world-class experiences. We’ll empower you in a flexible environment, and fuel you and your extraordinary talents in a diverse and inclusive culture of globally connected teams. Learn more.\nAre you ready to shape your future with confidence? Apply today.\nTo help create an equitable and inclusive experience during the recruitment process, please inform us as soon as possible about any disability-related adjustments or accommodations you may need.\nOur Commitment: As a commitment, we persistently endeavour to embody our values, fulfil our purpose, and champion inclusiveness. Our dedication is to cultivate EY into an environment where diverse perspectives are celebrated, creating a supportive atmosphere for individuals to authentically be themselves and contribute their utmost.\nProfessional Development: From entry-level employees to senior leaders, we believe in continuous learning. We offer opportunities to build new skills, take on leadership roles, and connect and grow through mentorship.\nPeople and Culture: In our dynamic workplace, diversity, equity, and inclusiveness are ingrained in our culture. We're united by a commitment to create an environment where every individual's differences are valued, practices are equitable, fostering a sense of belonging. Our shared values include integrity, respect, teaming, inclusiveness, energy, enthusiasm, courage to lead, and building relationships based on doing the right thing.\nBenefits: Embark on a transformative career journey with us and indulge in a suite of premium benefits, encompassing exclusive health and wellness packages, enticing rewards, and cutting-edge learning opportunities that empower you to continually grow and excel in your professional and personal development.\nHow to Apply: If you are passionate to join us and are aligned with our commitment to building a better working world, we invite you to apply by completing our user-friendly form with personal and professional information and by providing your consent to data privacy.\nSuccessful candidates advance to a competency-based interview. If mutual interest persists, a job offer awaits.\n“We are an equal opportunity employer and are committed to Diversity, Equity & Inclusion”.\nEY | Building a better working world\nEY is building a better working world by creating new value for clients, people, society and the planet, while building trust in capital markets.\nEnabled by data, AI and advanced technology, EY teams help clients shape the future with confidence and develop answers for the most pressing issues of today and tomorrow.\nEY teams work across a full spectrum of services in assurance, consulting, tax, strategy and transactions. Fueled by sector insights, a globally connected, multi-disciplinary network and diverse ecosystem partners, EY teams can provide services in more than 150 countries and territories.\nEY | Building a better working world\nEY exists to build a better working world, helping to create long-term value for clients, people and society and build trust in the capital markets.\nEnabled by data and technology, diverse EY teams in over 150 countries provide trust through assurance and help clients grow, transform and operate.\nWorking across assurance, consulting, law, strategy, tax and transactions, EY teams ask better questions to find new answers for the complex issues facing our world today.","description_format":"text","description_chars":11189,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Continuous learning","Equity","Professional development"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Financial Advisory, Valuation & Restructuring","Management Consulting","Tax Advisory & Preparation"],"lifecycle":[{"event":"open","at":"2026-11-13T10:49:17Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":21,"reasons":["conf:3","win:early","comp:junior,brand"],"computed_at":"2026-11-13T14:19:47Z"},"pay":null,"html_url":"https://alion.io/job/ey-cyber-detection-response-l3-analyst-2","json_url":"https://alion.io/job/ey-cyber-detection-response-l3-analyst-2.json","meta":{"generated_at":"2026-11-13T14:19:47Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":28671,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-14T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2859},"rest":"https://alion.io/mcp/rest/get_company?id=2859"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fey-cyber-detection-response-l3-analyst-2"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"free","price":{"credits":0,"usd":0},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fey-cyber-detection-response-l3-analyst-2"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fey-cyber-detection-response-l3-analyst-2"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/ey-cyber-detection-response-l3-analyst-2\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fey-cyber-detection-response-l3-analyst-2"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4233077}},{"tool":"search_jobs","arguments":{"company":"ey.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4233077},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}