(ACTIVE) Security Engineer (SIEM & SOAR) | Onsite/ Hybrid in QC

Gratitude Philippines; Manila; Hybrid; PHP 700,000 - 1,000,000; Full time

Job summary

Gratitude Philippines is seeking Security Engineers to design, implement, and manage security monitoring and automated response capabilities. You will partner closely with SOC teams, threat analysts, and IT stakeholders to strengthen detection coverage and accelerate incident response through automation.

Role focuses on SIEM engineering, SOAR automation, and security operations support with hybrid/on-site setup in the Metro Manila area.

Qualifications

• Bachelor's degree in Cybersecurity, IT, CS, or related field.
• 3-8 years of cybersecurity experience, with strong hands-on SIEM/SOAR.
• SOC experience is highly preferred.

Responsibilities

• Design, implement, and optimize SIEM solutions and playbooks.
• Develop correlation rules, dashboards, and reports to identify threats.
• Integrate data sources (network, endpoints, cloud, apps) into SIEM.
• Develop automated playbooks for incident response and enrichment.
• Partner with SOC analysts to streamline workflows and improve response.

Skills

SIEM/SOAR engineering

Automation scripting

MITRE ATT&CK/NIST/CIS

EDR/XDR & network security

Cloud security (AWS/Azure/GCP)

Education

Bachelor's degree in Cybersecurity/CS/IT

Tools

Splunk

Microsoft Sentinel

QRadar

Elastic/EDR tools

Cortex XSOAR / Splunk SOAR

Job description

Role Overview:

We are looking for Security Engineers to design, implement, and manage security monitoring and automated response capabilities. You will partner closely with SOC teams, threat analysts, and IT stakeholders to strengthen detection coverage and accelerate incident response through automation.

Key Responsibilities

SIEM Engineering & Management

• Design, implement, and optimize SIEM solutions (e.g., Splunk, Microsoft Sentinel, Google SecOps, QRadar, Elastic).
• Develop and maintain correlation rules, dashboards, and reports to identify threats and anomalies.
• Integrate diverse data sources (network, endpoints, cloud, applications) into the SIEM platform.
• Enhance data ingestion, parsing, and normalization to improve detection quality and reduce noise.

SOAR & Automation

• Implement and manage SOAR platforms (e.g., Cortex XSOAR, Splunk SOAR, IBM Resilient).
• Develop automated playbooks for incident response, alert triage, and threat intelligence enrichment.
• Collaborate with SOC analysts to streamline workflows and improve response efficiency.
• Maintain integrations with ticketing systems, threat intel feeds, and security tools.

Security Engineering & Operations Support

• Support incident response by delivering actionable alerts and automation-driven insights.
• Conduct root cause analysis of recurring threats and implement engineering solutions.
• Partner with audit and compliance teams to align security controls with regulatory standards.
• Provide training and documentation for SOC and IT teams on SIEM/SOAR platforms.

Qualifications

Education & Experience

• Bachelor's degree in Cybersecurity, IT, Computer Science, or related field.
• 3-8 years of cybersecurity experience, with strong hands-on experience in SIEM and/or SOAR engineering.
• Experience in a SOC environment is highly preferred.

Core Technical Skills

• Proven experience with at least one SIEM platform (Splunk, Sentinel, QRadar, ArcSight, Google SecOps).
• Hands-on experience developing SOAR playbooks and automation workflows.
• Scripting skills (Python, PowerShell, or Bash) for automation and integrations.
• Knowledge of frameworks such as MITRE ATT&CK, NIST, or CIS Controls.
• Familiarity with EDR/XDR, firewalls, IDS/IPS, and cloud security (AWS, Azure, or GCP).

Work Setup

• Willing to work on a shifting schedule.
• Open to hybrid or on-site work (Cyberpark, Cubao).