{"id":2539714,"url":"https://alion.io/job/xerox-soc-analyst","title":"SOC Analyst","company":{"id":63913,"name":"Xerox","domain":"xerox.com","url":"https://alion.io/company/xerox-corp","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Avature","truth_index":{"grade":"A","score":100,"open_postings":34,"ghost_share":0,"stale_share":0,"repost_share":0.029,"time_to_fill_p50_days":13,"computed_at":"2026-10-15T05:46:00Z"}},"role":"Security","role_family":"Security","seniority":"junior","employment_type":null,"work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Cebu City, Philippines"],"countries":["PH"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":10500,"max_usd":30000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":528},"experience_years_min":2,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"IAM","optional":false},{"name":"SIEM","optional":false},{"name":"AWS","optional":true},{"name":"Azure","optional":true},{"name":"Human-in-the-Loop","optional":true},{"name":"LLM","optional":true},{"name":"MITRE ATT&CK","optional":true},{"name":"PowerShell","optional":true},{"name":"Python","optional":true},{"name":"SQL","optional":true}],"status":"live","first_seen_at":"2026-10-14T15:15:07Z","employer_posted_date":"2026-10-14","last_verified_at":"2026-10-15T10:39:55Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"About Xerox Holdings Corporation\nFor more than 100 years, Xerox has continually redefined the workplace experience. Harnessing our leadership position in office and production print technology, we’ve expanded into software and services to sustainably power the hybrid workplace of today and tomorrow. Today, Xerox is continuing its legacy of innovation to deliver client-centric and digitally-driven technology solutions and meet the needs of today’s global, distributed workforce. From the office to industrial environments, our differentiated business and technology offerings and financial services are essential workplace technology solutions that drive success for our clients. At Xerox, we make work, work. Learn more about us at www.xerox.com.\nWe are seeking a Security Operations Center (SOC) Analyst, Level 2 to serve as a key line of defense in protecting Xerox information systems. You will triage and investigate security alerts, correlate evidence across multiple telemetry sources, and drive timely resolution or escalation. This role leverages AI-assisted detection and investigation capabilities to accelerate analysis while maintaining strict independent validation against authoritative telemetry and established runbooks.\nPurpose\nEnsure the security and integrity of organizational information systems by proactively monitoring, detecting, and investigating security threats. By maintaining a vigilant and responsive security posture, the SOC Analyst helps protect sensitive data, supports business continuity, and improves detection and response outcomes. The analyst uses AI-assisted capabilities to accelerate triage and investigations, while independently validating model outputs against authoritative telemetry and established procedures.\nScope\nAs an L2 SOC Analyst you will primarily focus on deeper analysis of security alerts and incidents that require cross-source correlation, hypothesis-driven investigation, and risk-based decisioning (e.g., monitor vs contain). You will execute response actions that are pre-approved in playbooks, verify outcomes, and escalate exceptions (critical assets, high business impact, ambiguous root cause, or destructive/high-blast-radius actions) to senior SOC/Incident Response resources. You will produce investigation artifacts (timeline, evidence, and queries used) suitable for peer review and audit and contribute to continuous improvement through structured feedback to detection engineering.\nInfluence\nAs a member of Xerox Cyber Security (XCS), the SOC Analyst actively influences the security culture through operational rigor, clear documentation, and disciplined escalation. You will share investigation insights to improve detections, reduce recurring false positives, and strengthen the organization’s overall security posture. You will also participate in security awareness and end-user engagement activities as needed to reinforce secure behaviors and reporting practices.\nKey Responsibilities\nIncident Monitoring, Investigation, and Response\nMonitor and triage security alerts and events using security tools and technologies (e.g., SIEM, EDR/XDR, IAM/IdP telemetry, email security, cloud audit logs).\nInvestigate medium-to-complex alerts to determine scope, impact, and likely root cause; build defensible incident narratives grounded in evidence.\nPerform cross-source correlation and create timelines across endpoint, identity, network, and cloud/SaaS telemetry to validate detections and identify related activity.\nUse hypothesis-driven investigation techniques: generate competing hypotheses, design targeted tests, and update conclusions as evidence changes.\nMake risk-based decisions aligned to runbooks (e.g., contain vs monitor); document rationale, confidence level, and next steps.\nAI-Assisted Investigation and Verification\nLeverage AI-assisted investigation capabilities (e.g., summarization, enrichment, clustering, prioritization) to accelerate triage while never accepting model outputs at face value; independently validate AI conclusions against authoritative telemetry before acting.\nTranslate 'why flagged' signals into evidence-based explanations suitable for peer review; identify and document inconsistencies, hallucinations, or missing context in AI outputs.\nExecute response actions that are pre-approved in playbooks (e.g., account containment requests, IOC blocking per procedure); verify outcomes and document success/failure states.\nEscalate cases with complete context (timeline, evidence, scope/impact, actions taken, recommended next steps) when severity, ambiguity, or business impact warrants senior involvement.\nDocumentation, Communication, and Automation Safety\nDocument investigations in the case management system, including queries used, evidence excerpts, timeline, decisions, actions taken, residual risk, and handoff notes.\nProvide structured feedback to detection engineering/ML stakeholders (TP/FP label and rationale, telemetry gaps, tuning recommendations) to improve alert fidelity.\nMaintain up-to-date knowledge of cybersecurity threats, attacker techniques, and detection best practices.\nBasic Qualifications\nBachelor's degree in computer science, Information Technology, or a related field (or equivalent practical experience).\n2+ years of experience in a Security Operations Center, security monitoring, or incident triage/investigation role (Level 2 or equivalent).\nApplied proficiency and experience investigating alerts using SIEM queries/pivots and one or more of the following: EDR/XDR, IAM/IdP telemetry, cloud audit logs, email security, network telemetry.\nStrong analytical and problem-solving skills; ability to conduct hypothesis-driven investigations and produce defensible conclusions.\nStrong written and verbal communication skills; ability to collaborate effectively across teams and produce case notes suitable for peer review and audit.\nAbility to work in a fast-paced environment and manage multiple concurrent investigations, including clean handoffs across shifts.\nWorking knowledge of AI-assisted security operations concepts and limitations (e.g., false positives, bias, hallucinations) with a bias toward validation and evidence.\nDiscipline in sensitive data handling and data minimization when using AI tools (use approved platforms; redact/exclude unnecessary sensitive details).\nPreferred Qualifications\nCertifications such as CompTIA Security+, CEH, GIAC (e.g., GCIH/GCIA/GMON), or similar.\nExperience with MITRE ATT&CK mapping and using it to structure investigations and communicate findings.\nExperience investigating cloud environments (AWS, Azure) and interpreting cloud/SaaS audit telemetry.\nExperience with scripting or query languages (e.g., Python, PowerShell, SQL) for basic enrichment, log parsing, and analysis.\nExperience executing SOAR playbooks with appropriate human-in-the-loop approvals and validation/rollback awareness.\nExperience contributing to detection improvements (writing/adjusting SIEM queries, proposing tuning changes, documenting repeatable triage logic).\nExperience using LLM/AI copilots for investigation acceleration with strict validation and data-handling practices.","description_format":"text","description_chars":7158,"description_truncated":false,"requirements":{"experience_years_min":2,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":true},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"Philippines","iso":"PH","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Document Management","Printers & Scanners","Managed Print Services"],"lifecycle":[{"event":"open","at":"2026-10-14T15:15:07Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":0,"expected_fill_days":13,"reasons":["conf:3","velocity","win:early","comp:junior,brand"],"computed_at":"2026-10-15T05:46:00Z"},"pay":null,"html_url":"https://alion.io/job/xerox-soc-analyst","json_url":"https://alion.io/job/xerox-soc-analyst.json","meta":{"generated_at":"2026-10-15T14:00:36Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":21459,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-16T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":63913},"rest":"https://alion.io/mcp/rest/get_company?id=63913"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fxerox-soc-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fxerox-soc-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fxerox-soc-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/xerox-soc-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fxerox-soc-analyst"}]}