Client Security Lead (CSL)

Theos; Taguig; On-site; PHP 900,000 - 1,500,000; Full time

Job summary

Theos is seeking a Client Security Lead to own MTDR service delivery for defined client accounts in the Philippines. You will ensure detection quality, threat hunting, and collaboration with the client and SOC teams to safeguard environments.

You will translate client context into actionable detections, manage investigations, and drive improvements in detection engineering and incident response across engagements.

Qualifications

• Detection engineering: write and tune non-trivial detection logic.
• Incident analysis & threat hunting: experience leading hunts and IR.
• Cloud & identity security: knowledge of major cloud/identity platforms.
• Client & stakeholder capability: ability to explain tech to leadership.
• Nice to have: MSSP/consulting background; IR/forensics; scripting skills.

Responsibilities

• Be the client’s security champion and maintain deep context of their architecture.
• Lead monthly reviews of events and security posture improvements.
• Bridge gaps between client and SOC; convey context to analysts and engineers.
• Run threat hunts based on CTI, known gaps, and ATT&CK mappings.
• Translate threat intel into detections and reduce noise in alerts.
• Assist during real incidents with log correlation and root-cause analysis.
• Contribute context and detection logic to incident response engagements.
• Mentor analysts and improve detection engineering across accounts.

Job description

About THEOS

Our Mission

Our mission is to empower businesses to thrive in the digital security age by defining and executing practical strategies that build true cyber resilience. At Theos, security is not an afterthought. It is our foundation. We believe in disciplined execution over silver bullets, and real outcomes over noise.

Who We Are

Theos is a cybersecurity company delivering premium services across Asia and beyond. We support SMEs and enterprises with capabilities traditionally reserved for global Tier-1 firms, spanning Penetration Testing, Red Teaming, Managed Detection and Response, and Digital Forensics and Incident Response. We combine deep technical capability with commercial discipline and operational maturity.

Our culture is grounded in five core values: Security as Our Foundation; Global Collaboration and Respect; Embrace Change and Innovate; Integrity and Accountability; and Strive for Excellence.

As we grow, we are building a culture that moves from heroics to process, from reaction to discipline, and from surviving to thriving. We value ownership, clarity, execution, and people who continuously raise the standard for themselves, their teams, and our clients.

The Role

Most clients do not want more alerts. They want to know that someone who understands their environment is looking after it, and they want a straight answer when they ask a question. That is this job.

The Client Security Lead (CSL) is the named technical security owner for a defined set of client accounts and is accountable for the effectiveness and continuous improvement of the MTDR service delivered to those clients.

The CSL is the two-way technical interface between the client and Theos Defence. They represent the client within the SOC, ensuring analysts understand the client's environment, technology, business context and security priorities. At the same time, they represent the MTDR service to the client, explaining what is being detected, why it matters, what has been investigated, and what should happen next.

The CSL personally is responsible for detection quality and engineering, threat hunting and technical investigation for their assigned accounts, while providing technical leadership and quality oversight to the analysts supporting them.

What you will do

Be the client’s security champion

Maintain deep context of their architecture, asset inventory, and strategic roadmap so you can anticipate monitoring gaps before they become blind spots. Lead monthly reviews to walk through events of interest and security posture enhancements.

Bridge the gap between the client and the SOC.

You’re the insider advocate for your accounts. Bring client context to our analysts and engineers so no one is ever triage-ing alerts blindly. Handle escalations when an analyst gets stuck or needs deep client context.

Run real, hypothesis-driven threat hunts.

Skip the lazy port scans. You’ll form hypotheses based on sector-relevant CTI, known detection gaps, and actual attack paths (ATT&CK mapped). Find the stuff our automated rules missed.

Convert Threat Intel into detections.

Intel without action is just news. Monitor the evolving threat landscape for your clients' technologies, translating relevant indicators and TTPs into actionable detection logic.

Kill the noise (Own Detection Quality).

High-noise, zero-signal alerts are a crime. Continuously audit, tune, and prune detection rules for your accounts. Every noisy alert gets reviewed and either fixed or killed.

Spot the non-detection flaws.

If you find a misconfiguration, a glaring AD risk, or a broken baseline control while hunting, don't keep quiet. Bring concrete, sensible fixes to the client and help them remediate it.

Get hands-on during real incidents.

When a major incident hits your account, you’ll be diving deep into the logs. Correlate telemetry across endpoint, identity, cloud, and network logs to construct a clear timeline, blast radius, and root cause analysis.

Support cyber response operations.

Contribute environment context, custom hunting queries, and detection logic to active compromise assessments and incident response engagements.

Level up the analysts.

Do quality checks on investigations, mentor junior analysts, and treat their daily pain points as fuel for detection engineering improvements.

What We’re Looking For

1. Detection Engineering

You’ve built, tuned, and retired detection rules in major SIEM/XDR platforms. Direct experience with Microsoft Sentinel or CrowdStrike Falcon is a huge plus, but strong query fluency on another platform works too.

You can write non-trivial detection logic independently.

You get that tightening a rule to cut down alert fatigue inherently risks missing edge cases, and you can comfortably weigh that trade-off.

2. Incident Analysis & Threat Hunting

Experience in threat hunting or incident response. You’ve owned hunts and incidents from initial signal to root cause, not just closed out surface-level alerts.

You can structure a hunt around a testable hypothesis and, crucial for a real hunter, you know what evidence would prove your theory wrong.

You can piece together logs across endpoint, identity, cloud, and network to reconstruct a clear timeline and map the blast radius.

3. Cloud & Identity Security

Working knowledge of at least one major cloud/identity ecosystem (Microsoft Azure, Entra ID, M335, or AWS).

You can trace activity through cloud audit and sign-in logs, whether it’s token theft, privilege escalation, malicious mailbox rules, or anomalous resource access and map it back to endpoint activity.

You understand how real-world cloud/identity attacks operate in practice (e.g., password spraying, consent phishing, excessive permission abuse).

4. Client & Stakeholder Capability

Comfortable sitting across from senior leadership and technical teams alike. You can drill down into technical nuances or zoom out to explain business impact and risk to non-technical decision-makers.

You write crisp, professional documentation that can go straight to a client without needing an editor to rewrite it.

You map out unfamiliar technical environments quickly and keep your mental model updated as things change.

5. Nice to Have (Not Required)

Multi-Account MSSP/Consulting Background: Experience juggling multiple client accounts simultaneously.

Formal IR or compromise assessment background, including forensic timeline reconstruction and evidence handling.

Python or PowerShell skills to quickly prototype tools or automate repeatable workflows.

Practical understanding of AI/AI Agent security risks and novel attack vectors.

Familiarity with threat actors, TTPs, and sector risks specific to the Asia-Pacific region.