Security Analyst (SIEM)

🛡️ Blue Team Security Analyst 

Department: IT Infrastructure & Security
Reports To: IT Manager / Security Lead
Location: Manila, Philippines

About the Role

Are you passionate about cybersecurity and threat detection? We're looking for a Blue Team Security Analyst who can proactively monitor security events, investigate threats, identify vulnerabilities, and help strengthen our overall security posture.

In this role, you'll work across endpoints, networks, cloud services, and identity platforms to detect and respond to security incidents before they impact the business. You'll collaborate closely with IT teams to drive remediation efforts, improve security monitoring, and support a culture of continuous security improvement.

🔍 Key Responsibilities

Security Monitoring & Threat Detection

• Monitor and analyze security events from SIEM platforms, firewalls, endpoint protection tools, identity systems, servers, and cloud applications.
• Investigate suspicious activities including:
  • Unauthorized login attempts
  • Malware detections
  • Privilege escalations
  • Unusual network or data transfer activity
  • Indicators of compromise (IOCs)
• Validate alerts and determine severity, business impact, and required actions.
• Correlate logs and events across multiple systems to identify attack patterns and security risks.
• Improve detection rules, alert tuning, and monitoring coverage to reduce false positives and increase visibility.

Vulnerability Management

• Conduct authorized vulnerability assessments across endpoints, servers, network devices, and business applications.
• Review and validate scan results to eliminate false positives.
• Prioritize vulnerabilities based on risk, exploitability, business impact, and asset criticality.
• Coordinate remediation efforts with system administrators and technical teams.
• Track identified vulnerabilities through resolution and verify fixes through follow-up assessments.
• Review system configurations and recommend improvements to hardening, patch management, access controls, and endpoint security.

Incident Response

• Triage and investigate cybersecurity incidents.
• Assist with containment, eradication, recovery, and post-incident activities.
• Preserve logs, evidence, and investigation records in accordance with company procedures.
• Document findings, timelines, root causes, and remediation recommendations.
• Escalate significant threats with clear impact assessments and actionable recommendations.
• Support the refinement of incident response processes and procedures.

Security Reporting & Continuous Improvement

• Prepare reports and dashboards covering:
  • Security alerts
  • Incident trends
  • Vulnerability status
  • Remediation progress
  • Security gaps and recommendations
• Maintain and improve security playbooks, standard operating procedures, and documentation.
• Collaborate with IT teams and service providers to enhance logging, monitoring, and security controls.
• Recommend security improvements based on emerging threats and lessons learned from investigations.
• Participate in security awareness and continuous improvement initiatives.

✅ Required Qualifications

• Bachelor's Degree in Information Technology, Cybersecurity, Computer Science, or a related field, or equivalent practical experience.
• Minimum 3 years of experience in:
  • Security Operations (SOC)
  • Blue Team Operations
  • Incident Investigation
  • Vulnerability Management
  • Security Monitoring
• Hands-on experience with SIEM solutions or centralized log management platforms.
• Experience performing vulnerability assessments and tracking remediation efforts.
• Strong understanding of:
  • Windows and Linux operating systems
  • Active Directory
  • Microsoft 365
  • Microsoft Entra ID
  • Identity and Access Management (IAM)
• Knowledge of:
  • TCP/IP
  • DNS
  • HTTP/HTTPS
  • Authentication protocols
  • Network security concepts
  • Common cyberattack techniques
• Ability to analyze endpoint, network, identity, and application logs.
• Familiarity with incident response methodologies and MITRE ATT&CK framework.
• Strong analytical, troubleshooting, and communication skills.

⭐ Preferred Qualifications

• Experience with:
  • Microsoft Defender
  • Microsoft Sentinel
  • Fortinet Security Solutions
  • Sophos
  • Splunk
  • Wazuh
• Familiarity with:
  • Microsoft Intune
  • AWS
  • UniFi Networking
  • Synology NAS
• Experience with vulnerability management tools such as:
  • Nessus
  • Qualys
  • Rapid7
• Basic scripting and automation skills using:
  • PowerShell
  • Python
  • Bash
• Relevant certifications such as:
  • CompTIA Security+
  • CySA+
  • Blue Team Level 1 (BTL1)
  • Microsoft SC-200
  • Other cybersecurity certifications

🎯 What Success Looks Like

✅ Security threats and alerts are investigated and escalated within defined response times

✅ Vulnerabilities are accurately prioritized and remediated within target timelines

✅ Security incidents are thoroughly documented with actionable recommendations

✅ Monitoring effectiveness improves while false positives are reduced

✅ Security controls, visibility, and detection capabilities continuously mature

✅ Strong collaboration with IT teams to improve overall security posture

🚀 Why Join Us?

🔐 Protect critical business systems and data

🕵️ Investigate real-world threats and security incidents

☁️ Work with modern security, cloud, and identity platforms

📚 Grow your cybersecurity expertise through continuous learning

🤝 Collaborate with experienced IT and security professionals

📈 Build your career in a fast-growing and security-focused environment

Be on the front lines of cybersecurity and help keep our organization secure. 🛡️💙