Hybrid Cloud Security Analyst - Incident Response

Staffstream; Taguig; Hybrid; PHP 900,000 - 1,200,000; Full time

Benefits offered by this job

HMO with 1 free dependent

Life Insurance

Paid Leave Credits

Government-mandated benefits

Work-from-home equipment provided

Job summary

Staffstream seeks a Senior Security Analyst to strengthen cyber defense across a cloud-only Microsoft 365 environment. The role combines hands-on incident response with leading security uplift projects in a hybrid setup at our Taguig location.

You will manage alerts, perform end-to-end investigations, develop detection rules with KQL, and drive initiatives like MFA maturity and conditional access, leveraging Defender and Intune to enhance device and data security.

Qualifications

• Bachelor's degree in Computer Science, Information Systems, or related field.
• 2–3+ years as Security Analyst, SOC Analyst, or Blue Team.
• Hands-on with Microsoft Defender suite and Entra ID.
• Experience with KQL for threat hunting and detection.
• Experience with Intune for endpoint security.
• Experience with MCAS and Purview.
• Hybrid on-site in BGC, Taguig; Philippine-based employment.

Responsibilities

• Own day-to-day security alert queue across Microsoft 365 Defender, Sentinel, and Entra ID.
• Investigate and resolve incidents end to end using standard workflows.
• Execute playbooks for phishing, identity compromise, data exfiltration, etc.
• Write, tune, and maintain KQL queries and detection rules.
• Drive security uplift projects: MFA, Conditional Access, app control, data-layer protections.
• Deploy hardening policies in Intune and maintain governance with Defender / Purview.
• Report incidents to regulators and maintain SOC playbooks.

Skills

KQL query writing

Threat hunting

Incident response

Security mindset

Education

Bachelor's degree in Computer Science/IS

Tools

Microsoft Defender suite

Entra ID / Azure AD

Microsoft Intune

MCAS

Purview

Sentinel

Job description

Staffstream seeks a Senior Security Analyst to strengthen cyber defense across a cloud-only Microsoft 365 environment. The role combines hands-on incident response with leading security uplift projects in a hybrid setup at our Taguig location.

You will manage alerts, perform end-to-end investigations, develop detection rules with KQL, and drive initiatives like MFA maturity and conditional access, leveraging Defender and Intune to enhance device and data security.