{"id":3064139,"url":"https://alion.io/job/penbrothers-soc-analyst","title":"SOC Analyst","company":{"id":50087,"name":"Penbrothers","domain":"penbrothers.com","url":"https://alion.io/company/penbrothers","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"staffing","is_intermediary":false,"listed_via":null,"ats_vendor":"Career site","truth_index":{"grade":"B","score":81,"open_postings":16,"ghost_share":0,"stale_share":0.75,"repost_share":0,"time_to_fill_p50_days":50,"computed_at":"2026-10-28T05:59:10Z"}},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Mandaluyong, Philippines"],"countries":["PH"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":13000,"max_usd":32000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":854},"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Crowdstrike","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"SentinelOne","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false},{"name":"Active Directory","optional":true},{"name":"AWS","optional":true},{"name":"Azure","optional":true},{"name":"DNS","optional":true},{"name":"IBM QRadar","optional":true},{"name":"Microsoft Entra ID","optional":true},{"name":"Microsoft Office","optional":true}],"status":"live","first_seen_at":"2026-10-10T18:53:40Z","employer_posted_date":"2026-10-22","last_verified_at":"2026-10-29T01:04:01Z","board_verified":true,"closed_at":null,"days_open":18,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":18},"description":"About Penbrothers\nPenbrothers is an HR & remote talent management partner and one of the fastest-growing companies in the Philippines. We provide talented Filipinos with global opportunities in high-growth startups and dynamic companies, from the comfort of their own homes.\nAbout The Role\nAs SOC Analyst, Consultant you will create and maintain the safest operating environment for the client, employees and clients. You will defend network boundaries, keep computer systems and network devices hardened against attacks and provide security services to protect sensitive data (e.g., passwords and customer information). You will monitor our systems for attacks and intrusions and work to proactively identify flaws and\nvulnerabilities.\nWhat You Will Do\nLead Advanced Security Investigations: Conduct in-depth investigations of escalated security incidents using CrowdStrike Falcon and other relevant log sources to determine how an attack occurred, identify the initial access point, trace subsequent malicious activity, and establish the full scope of compromise across affected endpoints, systems, and user accounts.\n\nPerform Advanced EDR Analysis: Investigate and analyze security detections beyond initial alert validation, leveraging endpoint telemetry, process execution data, and related indicators to reconstruct attacker activity, assess threats, and determine the nature and severity of incidents.\n\nExecute Threat Hunting and Detection Analysis: Perform targeted threat hunting, analyze indicators of compromise (IoCs), and assess adversary tactics, techniques, and procedures (TTPs) to identify malicious activity, validate threats, and support improvements to detection and prevention capabilities.\n\nOwn Incidents Through Remediation Recommendations: Take ownership of escalated incidents from initial investigation through containment and remediation planning. Develop evidence-based assessments, determine root causes where possible, and provide clear, actionable recommendations to customers to support effective incident resolution.\n\nMake Independent Containment Decisions: Assess incident severity, available evidence, potential business impact, and customer authorization boundaries to determine appropriate containment and response actions. Independently execute authorized actions, including endpoint isolation, blocking malicious indicators, and disabling compromised accounts when warranted.\n\nProvide Actionable Remediation Guidance: Recommend appropriate eradication and recovery measures, including patching, system rebuilding, configuration changes, and other corrective actions for implementation by the customer or designated internal teams. Clearly communicate the urgency, rationale, and potential impact of recommended actions.\n\nManage Security Escalations: Independently assess, prioritize, and route incidents requiring customer review, urgent incident escalation, or assistance from management and specialized internal teams. Recognize active hands-on-keyboard activity and other high-risk scenarios that require immediate escalation, ensuring timely communication and appropriate ownership.\n\nCommunicate Findings to Customers and Stakeholders: Translate technical investigation findings into clear incident summaries, explain the attack path and scope of compromise, communicate containment decisions, and present prioritized recommendations to customers and relevant stakeholders.\n\nMaintain Incident Documentation: Document investigation findings, supporting evidence, affected assets and accounts, containment actions, escalation decisions, incident timelines, and remediation recommendations in accordance with established operational procedures and customer requirements.\n\nLeverage Security Tools and Threat Intelligence: Maintain strong working knowledge of EDR/XDR, SIEM, and relevant security monitoring platforms, using available telemetry and threat intelligence to support investigations, validate malicious activity, and improve incident handling effectiveness.\n\nImprove MDR Operations and Detection Capabilities: Contribute to the continuous improvement of investigation playbooks, standard operating procedures, response workflows, and detection logic. Identify opportunities to improve alert quality, investigation efficiency, escalation practices, and the overall effectiveness of the MDR service.\n\nCollaborate Across Security and Technical Teams: Work closely with customers, SOC colleagues, security engineering, IT, and other technical teams to coordinate incident handling, validate findings, facilitate remediation, and resolve complex security issues.\n\nParticipate in Rotational and After-Hours Coverage: Support after-hours and on-call incident escalation and response requirements, ensuring timely investigation, sound response decisions, and effective incident coordination.\n\nQualifications:\nBachelor degree in information technology, Computer Science, Cybersecurity, or a related discipline, or equivalent professional experience.\n\nExpertise in investigating and mitigating security incidents across diverse environments, including on-premises, cloud, and hybrid infrastructures.\n\nAn experienced (Level 2 or 3) Analyst, looking to develop and grow a SOC service and team.\n\nStrong understanding of threat intelligence integration, adversary TTPs, and the MITRE ATT&CK framework.\n\nDesired Certifications: CompTIA Security+ and Cybersecurity Analyst (CySA+), ISC2 CC and SSCP, EC-Council Certified Incident Handler (ECIH), GIAC Certified Incident Handler (GCIH), and SIEM/EDR certifications (e.g., Splunk, Chronicle, CrowdStrike, SentinelOne) are a plus.\n\nAdvanced English (C1).\n\n3-5 years of hands-on experience in SOC operations, preferably for a SOC or MDR service provider (e.g.,MSSP).\n\nProficiency with SOC technologies, including SIEM (e.g., Chronicle, Splunk, IBM QRadar), EDR/XDR (e.g.,Trellix, CrowdStrike, SentinelOne, BlackPoint), and SOAR platforms (e.g., Chronicle, FortiSOAR, Splunk SOAR).\n\nExperience responding to alerts related to Microsoft Office 365, Identities (Entra ID, Active Directory),Cloud (AWS, Azure), Firewalls, Endpoint security, Email security, Web security (IP, DNS Filtering).\n\nOur Hiring Process & AI Disclaimer: We use AI tools to streamline our application process-including an initial conversation with an AI Interviewer. All hiring decisions are made entirely by humans: our Talent Acquisition team guides your full candidate journey and makes all evaluation decisions.\nYou are welcome to use AI for CV refinement and research, but real-time AI assistance during interviews or skill assessments is strictly prohibited to ensure an authentic evaluation.\nRead our full AI Disclaimer to learn more\nWhat You’ll Get\nAt Penbrothers, we are obsessed with creating positive employee experiences. Here you’ll find an environment that nurtures learning and provides opportunities for growth. You’ll have the opportunity to make an impact on fast-growing startups and dynamic companies.\n· Meaningful work & Growth: We take every opportunity to stretch ourselves and deliver an excellent client experience.\n· Employee as our biggest asset: We are genuinely invested in our people’s career and welfare.\n· Global reach & local impact: Get to work with high-growth startups and dynamic companies from the comfort of your own home.\n· Powering global startups: We’ve created 1,400 Filipino jobs that empower global start-ups to focus on growth.","description_format":"text","description_chars":7422,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"English","level":"Advanced (C1)","optional":false}]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","E-learning","Virtual Events"],"lifecycle":[{"event":"open","at":"2026-10-22T07:19:15Z"}],"visa":[],"liveness":{"score":62,"band":"ok","label":"Likely open","p_open":1,"p_active":0.622,"p_room":1,"age_days":17,"expected_fill_days":50,"reasons":["conf:3","stale_co","velocity","win:early"],"computed_at":"2026-10-28T05:59:10Z"},"pay":null,"html_url":"https://alion.io/job/penbrothers-soc-analyst","json_url":"https://alion.io/job/penbrothers-soc-analyst.json","meta":{"generated_at":"2026-10-29T04:06:06Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":6288,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-30T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":50087},"rest":"https://alion.io/mcp/rest/get_company?id=50087"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fpenbrothers-soc-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fpenbrothers-soc-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fpenbrothers-soc-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/penbrothers-soc-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fpenbrothers-soc-analyst"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3064139}},{"tool":"search_jobs","arguments":{"company":"penbrothers.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3064139},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}