Cybersecurity Analyst

CITADEL Pacific Ltd.; Taguig; On-site; PHP 420,000 - 720,000; Full time

Job summary

CITADEL Pacific Ltd. is seeking a Cybersecurity Analyst to support day-to-day security operations, platform administration, evidence collection, and policy enforcement.

Under guidance of the Senior Security Engineer, you will help maintain security controls, identify risks, and improve operational effectiveness while developing technical proficiency and ownership of assigned security processes. The role covers security operations, platform administration, identity and access governance, endpoint

Qualifications

• Bachelor's degree in IT, CS, cybersecurity or related field; equivalent practical experience considered.
• At least two years in cybersecurity, IT operations, systems administration or related technical role.
• Foundational security concepts including MFA, least privilege, logging and phishing.
• Ability to follow procedures, analyze evidence, document findings, and manage actions reliably.
• Hands-on exposure with Microsoft 365, Entra ID, Defender, Purview, MDM, EDR, SIEM or email-security tools.

Responsibilities

• Review security alerts and user concerns using approved playbooks; document findings and escalate.
• Support incident coordination, evidence gathering, timelines, and closure documentation.
• Track SOC/MDR cases and ensure information is available and actions followed.
• Maintain dashboards, recurring reports and metrics with source evidence.
• Perform routine admin tasks: health checks, access reviews, policy verification, and evidence collection.
• Assist with privileged access governance, vaulting, rotation and recertification.
• Monitor endpoint and email security consoles; triage events and escalate complex cases.
• Coordinate remediation with cross-functional teams, vendors and asset owners.

Skills

Analytical thinking

Documentation

Coordination

Communication

Education

Bachelor's degree in IT/CS/Cybersecurity/IS/Engineering

Equivalent practical experience

Tools

Microsoft 365

Entra ID

Defender

Purview

MDM

EDR

SIEM

Vulnerability scanners

Email-security platforms

PowerShell

Python

API

Reporting

Job description

The Cybersecurity Analyst supports day-to-day cybersecurity operations and the implementation of securityinitiatives through monitoring, platform administration, evidence collection, testing, documentation, andcoordination. Working under established procedures and the technical guidance of the Senior SecurityEngineer, the role helps maintain security controls, identify potential risks, and improve operationaleffectiveness while progressively developing technical proficiency and ownership of assigned securityprocesses.

DUTIES AND RESPONSIBILITIES:

I.Security Operations & CaseSupport

• Review security alerts, service tickets and user-reported securityconcerns using approved playbooks; document findings andescalate based on severity and procedure.
• Support incident coordination, evidence gathering, timelines,action tracking and closure documentation.
• Track managed SOC/MDR cases, verify required information isavailable and follow up on agreed actions and service levels.
• Maintain operational dashboards, recurring reports and metricswith clear source evidence

II.Security PlatformAdministration

• Perform approved routine administration, health checks, accessreviews, inventory updates, policy verification and evidence
  collection for assigned security tools.
• Support onboarding of users, assets, log sources andintegrations using documented procedures and change controls.
• Validate that alerts, logs and reports are being generated asexpected; elevate data-quality or platform issues to the lead orvendor.
• Maintain accurate runbooks, knowledge articles, configurationrecords and operational checklists
  

III.Identity, PAM & AccessGovernance Support

• Support privileged account discovery, onboarding, ownervalidation, entitlement reviews and access recertificationactivities.
• Assist with PAM testing for vaulting, credential rotation, sessionrecording, JIT access and approved remote-access use cases.
• Track identity and privileged-access exceptions, aged actions
  and required approvals.
• Support investigations of suspicious sign-ins or access activityunder established procedures

IV.Endpoint, Device & EmailSecurity Support

• Monitor endpoint and email security consoles, triage routineevents, gather evidence and elevate confirmed or complexcases.
• Support endpoint coverage checks, policy validation, device compliance reporting and controlled pilot testing for Intune/MDMor EDR improvements.
• Assist with Mimecast and Microsoft email-security administration,
  testing, user-reported email analysis and documentation.
• Track remediation actions with Infrastructure, workplace
  technology and system owners.
  

V.Data Protection & ComplianceOperations

• Support DLP and information-protection pilots, test cases, alert
  review, evidence collection and policy-tuning analysis under
  approved guidance.
• Maintain inventories of labels, policies, exceptions, owners and
  test results for Microsoft Purview or related controls.
• Coordinate with data owners and business stakeholders to
  validate legitimate activity and route possible violations for
  review.
• Support audit, control-testing and compliance evidence requests
  

VI.Vulnerability & ExposureManagement Support

• Consolidate scan and assessment results, validate asset
  ownership and maintain remediation trackers.
  Prepare recurring exposure reports, aging views and follow-up
  lists based on approved prioritization criteria.
• Coordinate evidence of remediation and retesting with
  Infrastructure, application teams, vendors and asset owners.
• Escalate critical, overdue or unowned findings to the Senior
  Security Engineer and Cybersecurity Operations Head.

Preferred Qualifications:

• Bachelor's degree in Information Technology, Computer
  Science, Cybersecurity, Information Security, Engineering, or
  a related field.Equivalent practical experience may be considered.At least two (2) years of relevant experience incybersecurity, IT operations, systems administration,network support, cloud support, or a relatedtechnical role.
• Foundational understanding of security concepts,including least privilege, MFA, endpoint protection,phishing, vulnerabilities, logging, and incidenthandling.
• Ability to follow procedures, analyze evidence,document findings, and manage assigned actionsreliably.
• Practical exposure through work, internship,laboratory exercises, or projects involving Microsoft365, Entra ID, Defender, Purview, MDM, EDR,SIEM, vulnerability scanners, or email-securityplatforms is an advantage.
• Basic knowledge of cybersecurity controls, securitymonitoring, identity and access management,endpoint protection, and vulnerability management.
• Good analytical, troubleshooting, documentation,and organizational skills.
• Effective communication and coordination skillswhen working with technical teams, businessstakeholders, and service providers.
• Basic PowerShell, Python, API, reporting, or data analysis skills are an advantage.
• Willingness to learn new security technologies andprogressively take ownership of assigned tools andprocesses.
• Security monitoring and basic alert analysis.
• Security platform administration and operationalsupport.
• Identity, privileged access, endpoint, email, anddata-protection controls.
• Vulnerability tracking, remediation coordination, andreporting.
• Evidence collection, technical documentation, andcompliance support.
• Problem-solving, attention to detail, accountability,and continuous learning.
• Relevant entry-level certifications, or active progress towardcertifications such as CompTIA Security+, ISC2 Certified inCybersecurity (CC), Microsoft SC-900, AZ-900, orequivalent, are an advantage.

About CITADEL Pacific

CITADEL Pacific Ltd. (CPL) is a diversified private holding company with operations in the Philippines, Hong Kong, Macau, the Republic of Palau, the Commonwealth of the Northern Mariana Islands, and the US Territory of Guam. Our holdings range from controlling stakes in companies engaged in telecommunications, retail, petroleum and gas distribution, commercial, and industrial property, in-flight catering, and manpower services. Recent acquisitions entering Solar and Data Center businesses position CITADEL to future facing and fast-growing industries in renewables energy and digital infrastructure. Our recent acquisitions of Solar and Data Center businesses position CITADEL in future-facing, fast-growing industries within the renewable energy and digital infrastructure sectors. We offer a competitive total rewards package which includes a base salary determined by factors such as role, experience, skill set, and location. Additionally, eligible employees may receive discretionary bonuses based on both company performance and individual achievements. Our benefits and programs are designed to meet the needs of our employees and are benchmarked to the market. Detailed information regarding compensation and benefits will be shared during the hiring process.