GSOC L3 - Manila

As part of the Cyber Defence team in the Global Security Operations Centre, you will provide oversight of triage, investigation of security alerts and potential security incidents. After a threat or incident is identified, L3 analyst will be responsible in determination of response that should be put into action to mitigate its damage and prevent its spread.

Fast and effective identification and triage of potential incidents is essential for us to protect our critical data and assets, and you will be at the forefront of this exciting area of Cyber Security, protecting the business and our interests daily.

You will need to have a good technical aptitude, a calm approach under pressure, excellent communicative skills to technical and nontechnical audiences, and have a genuine passion for security.

The Role

Technical:
Oversee the monitoring, investigation, containment, and eradication to cyber security threats against our business.
Lead the GSOC team in seeking out potential security issues through log analysis, and use of tools such as SIEM, UEBA, EDR, etc.
Responsible in determination of response that should be put into action to mitigate damage and prevent spread of security threats.
Escalate high priority or high severity alerts/incidents to escalations team and make sure they are monitored and handled according
to prescribed processes.
Ensure that there is a timely response to any cyber incidents to minimise the impact to the business, including interacting with
different technical teams and business areas where needed.
Represent GSOC to incident stand-up calls to assist GSOC Manager.
Using the latest threat intelligence to adapt your approach to detect the latest threats.
Ensure the team is working efficiently by identifying tuning opportunities, creating automation playbooks, and optimal use of
technology.
Review and provide technical advice on tuning recommendations submitted by Level 1s and Level 2s. Also, to improve the
businesses’ security posture against attackers and threats through fine tuning and rule creation.
Escalation point to provide process and/or technical advice for Level 1 and Level 2 analysts.
Perform quality audit for tickets that were handled by Level 2s ensure incidents were handled according to prescribed processes.
Attend handover calls to support Level 1s and Level 2s, provide advice (process/technical aspect) on alerts/incidents for
consultation.
May also be asked to lead teams/sub teams within the GSOC, as needed.
Provide on-call support (in rotation with other L3 Analysts). Will be called only when a high priority or high severity alert/incident
arise.

Non-Technical:
Ensures there is a balanced capacity and workforce to maintain delivery of a 24 x 7 SOC service.
Create and produce required regular report for leadership team and meaningful reports to articulate security posture, trends, and
patterns.
Assist L3 Manager to generate raw data for KPIs, submit calculations, record results, and recommend measures to maintain quality
performance.
Line management responsibilities for Level 1s and Level 2s such as performing necessary mentoring, coaching, and corrective
actions.
Help Level 2 analysts to deliver training to mature skills of new joiners or colleagues.
Conduct regular review of knowledgebases, processes, and runbooks to ensure they are up to date.
Regularly contribute to the SOC playbooks and knowledgebase with findings from investigations such as different attacker tools,
tactics, and procedures which can be applied to future investigations.

Internal:
Strong relationships will be needed with other SOC team members around the globe.
You will need to work with technical contacts throughout the business to remediate incidents.
You will need to brief the security leadership team on key incidents.
You may need to work with other business functions such as Governance Risk & Compliance, Legal, or Audit from time to time