Cybersecurity Analyst

CITADEL PACIFIC, LTD. - ROHQ; Taguig; Hybrid; PHP 500,000 - 800,000; Full time

Job summary

CITADEL Pacific Ltd. in the Philippines is seeking a Cybersecurity Analyst to support day-to-day security operations, monitor platforms, gather evidence, and document activities under the guidance of a Senior Security Engineer.

The role covers incident coordination, governance, and security controls across multiple domains. You will contribute to security platform administration, identity and access governance, endpoint and data protection, and vulnerability management while developing technical

Qualifications

• Bachelor's degree in IT/cybersecurity or related field is preferred.
• Foundational security concepts including MFA, least privilege, phishing, and logging.
• Ability to document findings and manage actions reliably.
• Practical exposure to Microsoft365, Entra ID, Defender, Purview, MDM, EDR, SIEM or email-security platforms is a plus.
• Basic knowledge of security controls, monitoring, IAM, and vulnerability management.
• Strong analytical, troubleshooting, documentation, and organizational skills.
• Effective communication and coordination with technical teams and stakeholders.
• Basic PowerShell, Python, API, or data analysis skills are advantageous.
• Willingness to learn new security technologies and take ownership of tools.
• Security monitoring and basic alert analysis.
• Security platform administration and operational support.
• Identity, privileged access, endpoint, email, and data-protection controls.
• Vulnerability tracking, remediation coordination, and reporting.

Responsibilities

• Review security alerts, service tickets and user-reported concerns using approved playbooks; document findings and escalate by severity.
• Support incident coordination, evidence gathering, timelines, action tracking and closure.
• Track SOC/MDR cases, verify information and follow up on actions and SLAs.
• Maintain operational dashboards, reports and metrics with source evidence.
• Perform routine platform administration, health checks, access reviews, inventory updates and policy verification.
• Support onboarding of users, assets, logs and integrations using change controls.
• Validate alerts, logs and reports are generated as expected.
• Maintain runbooks, knowledge articles and configuration records.
• Support privileged account discovery, onboarding, entitlement reviews and access recertification.
• Assist with PAM testing for vaulting, rotation, session recording, and JIT access.
• Track identity and privileged-access exceptions and approvals.
• Support investigations of suspicious sign-ins or access activity.

Skills

Analytical thinking

Troubleshooting

Documentation

Communication

Coordination

Attention to detail

Education

Bachelor's degree in Information Technology, Cybersecurity, or related field

Tools

Microsoft 365

Entra ID

Defender

Purview

MDM

EDR

SIEM

Job description

The Cybersecurity Analyst supports day-to-day cybersecurity operations and the implementation of securityinitiatives through monitoring, platform administration, evidence collection, testing, documentation, andcoordination. Working under established procedures and the technical guidance of the Senior SecurityEngineer, the role helps maintain security controls, identify potential risks, and improve operationaleffectiveness while progressively developing technical proficiency and ownership of assigned securityprocesses.

DUTIES AND RESPONSIBILITIES:

I.Security Operations & CaseSupport

• Review security alerts, service tickets and user-reported securityconcerns using approved playbooks; document findings andescalate based on severity and procedure.

• Support incident coordination, evidence gathering, timelines,action tracking and closure documentation.

• Track managed SOC/MDR cases, verify required information isavailable and follow up on agreed actions and service levels.

• Maintain operational dashboards, recurring reports and metricswith clear source evidence

II.Security PlatformAdministration

• Perform approved routine administration, health checks, accessreviews, inventory updates, policy verification and evidence
  collection for assigned security tools.

• Support onboarding of users, assets, log sources andintegrations using documented procedures and change controls.

• Validate that alerts, logs and reports are being generated asexpected;

• Maintain accurate runbooks, knowledge articles, configurationrecords and operational checklists

III.Identity, PAM & AccessGovernance Support

• Support privileged account discovery, onboarding, ownervalidation, entitlement reviews and access recertificationactivities.

• Assist with PAM testing for vaulting, credential rotation, sessionrecording, JIT access and approved remote-access use cases.

• Track identity and privileged-access exceptions, aged actions
  and required approvals.

• Support investigations of suspicious sign-ins or access activityunder established procedures

IV.Endpoint, Device & EmailSecurity Support

• Monitor endpoint and email security consoles, triage routineevents, gather evidence and escalated confirmed or complexcases.

• Support endpoint coverage checks, policy validation, device compliance reporting and controlled pilot testing for Intune/MDMor EDR improvements.

• Assist with Mimecast and Microsoft email-security administration,
  testing, user-reported email analysis and documentation.

• Track remediation actions with Infrastructure, workplace
  technology and system owners.

V.Data Protection & ComplianceOperations

• Support DLP and information-protection pilots, test cases, alert
  review, evidence collection and policy-tuning analysis under
  approved guidance.

• Maintain inventories of labels, policies, exceptions, owners and
  test results for Microsoft Purview or related controls.

• Coordinate with data owners and business stakeholders to
  validate legitimate activity and route possible violations for
  review.

• Support audit, control-testing and compliance evidence requests

VI.Vulnerability & ExposureManagement Support

• Consolidate scan and assessment results, validate asset
  ownership and maintain remediation trackers.
  Prepare recurring exposure reports, aging views and follow-up
  lists based on approved prioritization criteria.

• Coordinate evidence of remediation and retesting with
  Infrastructure, application teams, vendors and asset owners.

• Escalate critical, overdue or unowned findings to the Senior
  Security Engineer and Cybersecurity Operations Head.

Preferred Qualifications:

• Bachelor's degree in Information Technology, Computer
  Science, Cybersecurity, Information Security, Engineering, or
  a related field.Equivalent practical experience may be considered.At least two (2) years of relevant experience incybersecurity, IT operations, systems administration,network support, cloud support, or a relatedtechnical role.

• Foundational understanding of security concepts,including least privilege, MFA, endpoint protection,phishing, vulnerabilities, logging, and incidenthandling.

• Ability to follow procedures, analyze evidence,document findings, and manage assigned actionsreliably.

• Practical exposure through work, internship,laboratory exercises, or projects involving Microsoft365, Entra ID, Defender, Purview, MDM, EDR,SIEM, vulnerability scanners, or email-securityplatforms is an advantage.

• Basic knowledge of cybersecurity controls, securitymonitoring, identity and access management,endpoint protection, and vulnerability management.

• Good analytical, troubleshooting, documentation,and organizational skills.

• Effective communication and coordination skillswhen working with technical teams, businessstakeholders, and service providers.

• Basic PowerShell, Python, API, reporting, or data analysis skills are an advantage.

• Willingness to learn new security technologies andprogressively take ownership of assigned tools andprocesses.

• Security monitoring and basic alert analysis.

• Security platform administration and operationalsupport.

• Identity, privileged access, endpoint, email, anddata-protection controls.

• Vulnerability tracking, remediation coordination, andreporting.

• Evidence collection, technical documentation, andcompliance support.

• Problem-solving, attention to detail, accountability,and continuous learning.

• Relevant entry-level certifications, or active progress towardcertifications such as CompTIA Security+, ISC2 Certified inCybersecurity (CC), Microsoft SC-900, AZ-900, orequivalent, are an advantage.

_______________________

About CITADEL Pacific

CITADEL Pacific Ltd. (CPL) is a diversified private holding company with operations in the Philippines, Hong Kong, Macau, the Republic of Palau, the Commonwealth of the Northern Mariana Islands, and the US Territory of Guam.

Our holdings range from controlling stakes in companies engaged in telecommunications, retail, petroleum and gas distribution, commercial, and industrial property, in-flight catering, and manpower services. Recent acquisitions entering Solar and Data Center businesses position CITADEL to future facing and fast-growing industries in renewables energy and digital infrastructure. Our recent acquisitions of Solar and Data Center businesses position CITADEL in future-facing, fast-growing industries within the renewable energy and digital infrastructure sectors.

We offer a competitive total rewards package which includes a base salary determined by factors such as role, experience, skill set, and location. Additionally, eligible employees may receive discretionary bonuses based on both company performance and individual achievements. Our benefits and programs are designed to meet the needs of our employees and are benchmarked to the market. Detailed information regarding compensation and benefits will be shared during the hiring process.