Cybersecurity Incident Response Specialist

Metropolitan Bank & Trust Company; Metro Manila; On-site; PHP 900,000 - 1,500,000; Full time

Job summary

Metrobank is seeking a Cybersecurity Incident Response Specialist to lead investigations of escalated incidents and guide containment and remediation efforts. You will analyze malware and network activity, generate reports, and help improve the bank’s cyber defenses.

Ideal candidates bring 3–5 years of security operations experience, strong analytical and communication skills, and familiarity with SIEM and forensics tools.

Qualifications

• Bachelor’s degree in information security, CS, or ECE or related field.
• 3–5 years in information security, incident response or SOC operations.
• Hands-on in security monitoring, SIEM, threat detection, and log analysis.
• Knowledge of incident response, digital forensics, root cause analysis, and network security.
• Familiarity with Windows and Unix/Linux; strong communication and stakeholder skills.
• Certifications such as CEH, CISSP, CISA, GSEC, CHFI, GCIH, GCFA preferred.

Responsibilities

• Investigate and manage escalated security incidents; lead containment, eradication, recovery, and remediation.
• Analyze security data, identify threat patterns, and provide actionable recommendations.
• Produce incident reports, playbooks, metrics, and insights for continuous improvement.
• Coordinate with SOC Analysts and SOC Manager to strengthen operations and address gaps.
• Develop and maintain incident response playbooks; stay updated on emerging threats.

Skills

Analytical thinking

Investigation

Problem-solving

Communication

Stakeholder management

24x7 shift readiness

Education

Bachelor's degree in information security, Computer Science, Computer Engineering, or related field

Tools

SIEM

Threat intelligence platforms

Digital forensics tools

Malware analysis tooling

Job description

Be #InGoodHands with Metrobank!

Here at Metrobank, we don't simply hire employees—we hone future leaders. We provide opportunities that enhance your skills and unlock your talents, helping you evolve into a well-rounded individual. We supply you with all the pieces you need to do your best work, unleashing your full potential to help you secure your future and lead a fulfilling career. And with Metrobank's strong heart for the community, you have the chance to give back and make worthwhile contributions to our nation's economic and social development. With Metrobank, a meaningful life is within your reach!

The Cybersecurity Incident Response Specialist is responsible for investigating and managing escalated security incidents and conducting in-depth investigations to determine the scope, impact, and severity of security events. The role leads containment, eradication, recovery, and remediation efforts to minimize business risk and restore normal operations. It analyzes security data, identifies threat patterns, and provides actionable recommendations to prevent recurrence. The role also produces incident reports, playbook reviews, metrics, and insights to support the continuous improvement of the Bank's cybersecurity posture.

Key Responsibilities

• Serve as the primary escalation point for SOC Analysts and conduct in-depth investigations through data correlation, threat analysis, and root cause analysis to determine incident scope, risk, and severity.
• Provide guidance and oversight on incident containment, remediation, recovery, and resolution activities.
• Review incident tickets and ensure investigations conducted by SOC Analysts are thorough, accurate, and properly documented.
• Leverage threat intelligence to identify affected systems, determine attack scope, and assess potential impact.
• Document security incidents from initial detection through final resolution and closure.
• Develop, maintain, and enhance incident response playbooks.
• Stay current on emerging cyber threats, vulnerabilities, attack techniques, and applicable regulatory requirements.
• Support Threat Hunting activities by providing insights and recommendations for developing new threat detection and analytics methods.
• Analyze malware, network traffic patterns, and other security events to identify threats and recommend appropriate actions.
• Generate and submit incident reports, metrics, and operational reports on a daily, weekly, and monthly basis.
• Review security monitoring metrics and identify trends, anomalies, and opportunities for improving detection and response capabilities.
• Work closely with the SOC Manager to strengthen security operations and address identified process or control gaps.
• Participate in the evaluation, implementation, troubleshooting, and optimization of security tools and technologies.
• Perform other cybersecurity incident response and SOC-related duties as assigned by the SOC Manager.

Qualifications:

• Bachelor's degree in information security, Computer Science, Computer Engineering, or a related field.
• Minimum of 3-5 years of experience in Information Security, Incident Response, SOC Operations, Cybersecurity Operations, or a related field.
• Hands-on experience in security monitoring, SIEM operations, security event investigation, threat detection, and log analysis.
• Strong knowledge of incident response, digital forensics, malware analysis, root cause analysis, network security, and host-based investigations.
• Familiarity with Windows and Unix/Linux operating systems, authentication technologies, network protocols, and enterprise infrastructure environments.
• Understanding of cybersecurity frameworks, information security principles, risk management practices, and industry best practices.
• Knowledge of scripting, programming, system administration, and automation technologies is an advantage.
• Ethical hacking or penetration testing experience is an advantage.
• Strong analytical, investigative, problem-solving, communication, and stakeholder management skills.
• Ability to work in a 24x7 shift-based environment and support critical security incidents when required.
• Professional certifications such as CEH, CISSP, CISA, GSEC, CHFI, GCIH, GCFA, or equivalent are preferred.