Cyber Security Operations Center Engineer

DataOne; Davao City; On-site; PHP 900,000 - 1,500,000; Full time

Job summary

DataOne in Davao City, Philippines, is expanding its security operations to focus on threat detection, incident response, and security infrastructure management. You will work in a follow-the-sun SOC environment, collaborating with the global team to deliver audit-ready evidence for governance and compliance teams.

As a SOC Engineer, you will tune Wazuh for central logging and security monitoring, coordinate with IT and Compliance, and help implement Zero Trust concepts using modern tooling.

Qualifications

• 2–3 years in a SOC/Infrastructure Security role
• Professional fluency in English (written and spoken)
• Datacenter/enterprise security experience
• Strong collaboration with non-technical teams (Compliance/Legal)

Responsibilities

• Core focus on threat detection, incident response, and security infrastructure engineering.
• Audit & Compliance Support: provide evidence, logs, and vulnerability reports for audits.
• SIEM & Log Management: tune and optimize Wazuh across group infrastructure.
• Endpoint Defense: manage Bitdefender GravityZone for endpoint protection and isolation.
• Perimeter & Network Security: configure Fortinet devices and monitor IDS/IPS systems.
• Zero Trust Architecture: administer secure remote access with NetBird and WireGuard.
• Incident Response & Automation: orchestrate IR workflows and enrichment using TheHive and Cortex.
• Threat Intelligence & Vulnerability Management: aggregate IoCs via MISP, Shadowserver, and SOCRadar; CVE tracking via OpenVAS.
• Active Directory Auditing: risk scoring and mapping attack paths with BloodHound and PingCastle.
• Data Protection: assist in evaluating potential DLP solutions across DataOne and BSO systems.

Skills

Threat detection

Incident response

Security infrastructure

Tools

Fortinet FortiGate

FortiWAF

NetBird

WireGuard

TheHive

Cortex

OpenVAS

VulnTracker

BloodHound

PingCastle

Suricata

Job description

We are expanding our global security capabilities to deliver continuous, expert-level security operations across all DATAONE and BSO systems. Built on a foundation of proven open-source technologies and enterprise solutions, our security infrastructure is operated by a highly skilled, follow-the-sun team based in Casablanca and Davao.

Orchestrated directly by the SOC Manager, our SOC team focuses purely on detection, response, and cyber security infrastructure management. While the team does not manage regulatory compliance directly, you will act as the technical enabler for our governance goals by providing all necessary technical evidence and reports to the compliance team to ensure successful audits.

Key Responsibilities

• Core Focus: Dedicate operations entirely to threat detection, incident response, and security infrastructure engineering.
• Audit & Compliance Support: Collect, organize, and provide all required technical evidence, log extracts, and vulnerability reports to the compliance team to guarantee successful group audits.
• SIEM & Log Management: Maintain, tune, and optimize Wazuh for central logging, File Integrity Monitoring (FIM), and Host Intrusion Detection (HIDS) across all Group infrastructure.
• Endpoint Defense: Manage and deploy Bitdefender GravityZone for endpoint protection, threat detection, and automated host isolation during incidents.
• Perimeter & Network Security: Configure and monitor Fortinet NGFW/WAF for perimeter defense and web application security; manage network intrusion detection systems using Suricata.
• Zero Trust Architecture (ZTA): Administer and secure remote infrastructure access utilizing NetBird and WireGuard.
• Incident Response & Automation (SOAR): Orchestrate incident response workflows, incident management, and automated enrichment using TheHive and Cortex.
• Threat Intelligence & Vulnerability Management: Aggregate and analyze Indicators of Compromise (IoCs) via MISP, Shadowserver, and SOCRadar. Conduct scheduled scanning and CVE tracking using OpenVAS and VulnTracker.
• Active Directory Auditing: Execute risk scoring and map complex attack paths within Active Directory using BloodHound and PingCastle, ensure follow up actions with AD Admins
• Data Protection: Assist in evaluating and implementing a future Data Loss Prevention (DLP) solution to protect sensitive data across DataOne and BSO systems.

Required Technical Tooling

Practical, hands-on engineering knowledge of the following technologies:

• Firewall / WAF: Fortinet (FortiGate / FortiWAF)
• ZTA / VPN: NetBird, WireGuard
• SOAR / Case Management: TheHive, Cortex
• Vulnerability Assessment: OpenVAS, VulnTracker
• AD Auditing: BloodHound, PingCastle
• NIDS: Suricata

Qualifications & Requirements

• Experience: Minimum of 2–3 years of experience in a SOC Engineering, Systems Engineering, or Infrastructure Security role.
• Language: Professional fluency in English (written and spoken) is mandatory for collaborating across global sites and creating technical audit evidence.
• Datacenter/Enterprise Experience: Prior experience securing data center environments, cloud infrastructure, or large-scale enterprise networks is highly valued.
• Collaboration Skills: Proven ability to work alongside non-technical teams (like Compliance and Legal) to deliver clear, actionable data.