Principal SOC Analyst
Ceridian
- Principal SOC Analyst
- Req #24389
- Philippines
- Apply
- Share
- Job Description
- Posted Tuesday, July 28, 2026 at 4:00 PM | Expires Monday, September 28, 2026 at 3:59 PM
Dayforce is a global human capital management (HCM) company headquartered in Toronto, Ontario, and Minneapolis, Minnesota, with operations across North America, Europe, Middle East, Africa (EMEA), and the Asia Pacific Japan (APJ) region.
Our award-winning Cloud HCM platform offers a unified solution database and continuous calculation engine, driving efficiency, productivity and compliance for the global workforce.
Our brand promise - Makes Work Life Better™- Reflects our commitment to employees, customers, partners and communities globally.
About the Opportunity
The Principal SOC Analyst is a senior hands-on technical and operational role within Dayforce Cybersecurity Operations, responsible for advancing the effectiveness, maturity, and scalability of Security Operations. The role provides leadership in operational excellence (BAU), incident handling quality, process alignment, analyst enablement, and continuous improvement across a globally distributed environment.
The successful candidate serves as the principal technical and operational partner to Cybersecurity Security Operations leadership, translating strategic objectives into operational outcomes while driving process maturity, service quality, automation adoption, AI innovation, executive reporting, and continuous improvement across Cybersecurity Operations.
What You'll Get to Do
- Cybersecurity Security Operations BAU Leadership and Operational Execution (35%) – Support SOC leaders in the day-to-day technical management of SOC BAU operations by maintaining operational rhythm, monitoring service quality, coordinating priorities, improving handovers and escalations, and ensuring analysts have the clarity, guidance, and process discipline needed to deliver consistent outcomes.
- Incident Handling Oversight and Quality Improvement (20%) – Improve the quality, consistency, and timeliness of security incident handling by strengthening triage practices, escalation paths, evidence quality, case documentation, containment coordination, post-incident follow-up, and lessons-learned activities without becoming the primary owner of all day-to-day case work.
- Process Maturity and Continuous Improvement (20%) – Identify, analyse, and resolve recurring SOC operational issues by improving processes, playbooks, runbooks, quality controls, operating procedures, metrics, and governance practices that increase reliability, reduce friction, and mature the way the SOC operates.
- Automation, AI, and Operational Enablement (10%) – Drive practical improvement opportunities by leveraging automation, AI-assisted workflows, analytics, dashboards, and tool optimisation to reduce manual effort, improve decision quality, enhance analyst productivity, and create scalable operational practices across Cybersecurity Security Operations workflows.
- Stakeholder and Communication (10%) – Translate operational and technical matters into clear, concise communication for leaders, partners, engineering/application/support teams, incident management, and business stakeholders, including status updates, risk summaries, operational metrics, improvement plans, and decision-support materials.
- Analyst Enablement and Knowledge Management (5%) – Promote operational excellence through technical coaching, documentation, knowledge sharing, process improvement, and quality assurance activities that enhance analyst effectiveness and consistency, while partnering with people leaders on development initiatives as needed.
Skills and Experience We Value
- Deep hands-on experience in Security Operations. With a proven track record of operating as a senior analyst, technical lead, shift lead, SOC engineer, or deputy to SOC leadership in a complex security operations environment
- Strong understanding of SOC BAU, incident handling, and operational execution. Including alert triage, incident escalation, case quality, handovers, response coordination, post-incident follow-up, service quality, and the practical realities of running a high-performing SOC
- Proven ability to improve processes and operational maturity. Including the ability to identify recurring pain points, perform root cause analysis, define sustainable improvements, strengthen runbooks and playbooks, and drive measurable improvements in reliability, efficiency, and quality
- Broad technical knowledge of modern security operations technologies. Including SIEM, EDR, SOAR, network security, cloud security, identity security, threat intelligence, ticketing, ITSM, incident management, vulnerability management, and reporting platforms, with the ability to connect tools, workflows, and outcomes
- Practical capability to leverage automation, AI, and data-driven improvement. Including the ability to identify high-value automation opportunities, use analytics and metrics to support decisions, partner with engineering teams on workflow improvements, and apply AI-assisted approaches responsibly to improve operational effectiveness
- Strong stakeholder management and communication skills. With the ability to translate complex technical and operational topics into clear business language, prepare leadership-ready updates, influence stakeholders, and communicate effectively with technical and non-technical audiences
- Advanced technical, analytical, and leadership capabilities. Including sound judgement, calm decision-making under pressure, mentoring and coaching ability, strong documentation practices, familiarity with Agile or continuous improvement methods, and relevant industry certifications such as CEH, GASAE, CISSP, GCIH, Security+, CySA+, cloud security certifications, or equivalent experience.
What’s in it for you
Dayforce is fueled by the diversity of our talented employees. We are an equal opportunity employer and consider and embrace ALL individuals and what makes them unique.