Cybersecurity Incident Investigation Information Security Sr. Specialist

Smart Communications, Inc.; Makati; On-site; PHP 900,000 - 1,500,000; Full time

Job summary

Smart Communications, Inc. is seeking a cybersecurity professional to lead incident investigations and coordinate cross-functional response efforts in the Philippines.

You will perform root cause analysis and digital forensics, supporting remediation and resilience initiatives across the organization. Responsibilities include evidence collection, documentation, and reporting of metrics to management, with a focus on continuous improvement and regulatory compliance.

Qualifications

• 4–5 years of experience in cybersecurity, with focus on incident investigation.
• Hands-on experience in root cause analysis and digital forensics.
• Bachelor’s degree in IT/CS/Engineering or related field.
• Preferably holds relevant industry certifications listed in TRAINING/CERTIFICATIONS.

Responsibilities

• Coordinate and conduct end-to-end cyber investigations, including evidence collection, analysis, and documentation.
• Support continuous improvement of incident response processes by applying lessons learned from past incidents.
• Assist in tool deployment, configuration, and maintenance for investigation activities.
• Contribute to reporting and metrics on investigation effectiveness for senior management.
• Ensure compliance with regulations, standards, and policies; maintain audit-ready documentation.

Skills

Root cause analysis

Digital forensics

Incident investigation

Analytical thinking

Collaboration with security teams

Education

Bachelor’s degree in Information Technology/Computer Science/Engineering

Tools

SIEMs

Threat intelligence platforms

Job description

Support PLDT’s cybersecurity investigation efforts in identifying, analyzing, and resolving security incidents, breaches, and threats to help ensure the organization is prepared to respond effectively. Collaborate with security teams and stakeholders to coordinate investigative activities aimed at minimizing business impact. Conduct thorough and timely investigations, contributing findings that support remediation efforts and help enhance PLDT’s overall security posture and resilience.

Incident Investigation and Coordination

Conduct the end-to-end coordination of cyber investigation activities, including evidence collection, analysis, and documentation. Follow established investigation protocols, playbooks, and procedures that adapt to the evolving threat landscape. Ensure thorough documentation of investigation timelines, findings, actions taken, and lessons learned to support continuous improvement.

Continuous Improvement

Participate in the ongoing enhancement of incident response and investigation processes by applying lessons learned from past incidents. Stay current with industry best practices, cyber threats, and emerging attack techniques. Take part in regular training, simulations, and tabletop exercises to maintain and improve response capabilities.

Tool and Technology Management

Support the deployment, configuration, and maintenance of investigation tools and technologies. Collaborate with security teams and stakeholders to ensure integration with broader security systems such as SIEMs and threat intelligence platforms. Utilize available tools effectively to perform investigations efficiently.

Reporting and Metrics

Support in gathering and maintaining key metrics related to investigation effectiveness, such as case closure rates and time-to-resolution. Contribute to preparing reports on investigation status and performance for senior management, using data to identify opportunities for improving investigative strategies.

Compliance and Risk Management

Conduct investigation activities in accordance with applicable regulations, industry standards, and organizational policies. Work closely with risk management teams to interpret investigation findings and support risk mitigation efforts. Maintain accurate, comprehensive, and audit-ready documentation to facilitate compliance and regulatory reviews.

EDUCATION

Bachelor’s degree in Information Technology, Computer Science, Engineering, or any related course/discipline.

WORK EXPERIENCE

4–5 years of experience in cybersecurity, with focus on incident investigation. Hands‑on experience in root cause analysis and digital forensics.

TRAINING/CERTIFICATIONS

Preferably holds a combination of relevant industry recognized certification, such as:

• CFA – GIAC Certified Forensic Analyst
• GCIH – GIAC Certified Incident Handler
• CHFI – Computer Hacking Forensic Investigator
• CIRL – Cyber Incident Response Leader
• CISSP – Certified Information Systems Security Professional
• CISM – Certified Information Security Manager
• CEH – Certified Ethical Hacker