About the role
Do you want to take the first step in making Filipinos’ lives better everyday? Here in GCash we want to stay at the forefront of the FinTech industry by creating innovative, meaningful, and convenient financial solutions for the nation! G ka ba? Join the G Nation today! Key
Responsibilities 1. Alert Monitoring and Triage Monitor and respond to security alerts from SIEM or from various security tools or instrumentation such as endpoint security, secure email gateway, firewalls, IDS, DLP, etc. Acknowledge new alerts promptly and begin meaningful triage based on severity, context, and available evidence. Review alerts using established SOC triage playbooks and standard case disposition guidance. Determine whether activity is true positive, benign positive, false positive, or requires further investigation. 2. Investigation and Analysis Perform advanced incident response activities including discovery, threat analysis and correlation, response, remediation, and containment, at times involving network and endpoint forensics. Apply investigative logic using frameworks such as the Cyber Kill Chain and MITRE ATT&CK to understand attacker behavior, scope incidents, and assess likely impact. Validate whether reported activity is benign, expected, suspicious, or malicious before closure, escalation, or containment recommendation. Correlate evidence from SIEM, EDR, cloud, email, and network sources where applicable. 3. Case Documentation and Escalation Document investigations clearly and completely so that work can be reviewed, continued, or audited without repeating prior analysis. Produce escalation notes that include alert summary, affected assets, investigative steps performed, evidence gathered, and analyst hypothesis. Escalate cases when deeper response, stakeholder coordination, or containment approval is required. Ensure escalations are actionable and complete enough for immediate continuation by senior analysts, leads, or partner teams. Contribute to overall SOC processes, documentation, metrics, and reporting. 4. Containment and Response Support Support containment and response actions by validating risk, recommending next steps, and coordinating with leads, system owners, and supporting teams as needed. Participate in the investigation lifecycle from alert handling through validation, communication, and closure. Contribute to timely incident scoping and prioritization to improve mean time to detect, respond, and contain. Support or drive the remediation or closure of control gaps, risks, and findings from audits and certification activities. 5. Detection and Operational Improvement Identify recurring false positives, noise patterns, and weak detections, then recommend tuning opportunities to improve SOC efficiency. Contribute to SOC initiatives that enhance analyst productivity, detection quality, and operational maturity. Help translate observed attack patterns and investigative learnings into improved rules, playbooks, dashboards, and use cases. Core Deliverables Accurate and timely handling of security alerts and cases. Well-documented investigations and escalation artifacts. High-quality incident analysis aligned to SOC playbooks and threat frameworks. Recommendations for detection tuning, false-positive reduction, and process improvement. Minimum
