Incident Response Analyst

Dencom Consultancy and Manpower Services; Taguig; On-site; PHP 700,000 - 900,000; Full time

Job summary

A leading consultancy firm is seeking an Incident Response Analyst to manage and resolve cybersecurity incidents throughout their lifecycle. This role requires 4-5 years of experience in Incident Response or Security Operations at the L2/L3 level, along with expertise in threat investigation and creation of detection rules. The ideal candidate will have strong communication skills and a willingness to work shifting schedules. This hybrid position requires at least 8 days onsite each month and offers a dynamic work environment focused on cybersecurity.

Qualifications

• 4–5 years of relevant experience in Incident Response or Security Operations (L2/L3 level).
• Hands-on experience across the full Incident Response lifecycle.
• Ability to analyze and respond to complex security incidents.

Responsibilities

• Manage and resolve cybersecurity incidents across their full lifecycle.
• Identify emerging threats and create detection rules.
• Collaborate with cross-functional teams to improve security posture.

Skills

Incident Response

Security Operations

Cybersecurity frameworks

Threat investigation

Communication skills

Tools

SIEM

SOAR

EDR/XDR

Network security tools

Job description

Work Setup: Hybrid (Minimum 8 RTO days per month)

Schedule:

• Asia Pacific: 6:00 AM – 3:00 PM
• Europe, Middle East & Africa: 2:00 PM – 11:00 PM
• WHEM: 10:00 PM – 7:00 AM (next day)
• Workdays: Sunday–Thursday or Monday–Friday (depending on shift)
• Shift rotation: Every 2 months
• Other Requirements: Amenable to overtime, weekend work, and PH holidays when necessary

The Incident Response Analyst is responsible for managing and resolving cybersecurity incidents across their full lifecycle—from detection and analysis to containment, remediation, and recovery. This role requires advanced technical expertise in threat investigation, response methodologies, and security operations. The analyst will work closely with cross‑functional teams to develop and implement solutions that proactively strengthen the organization’s security posture.

As an L2/L3 escalation point, the Incident Response Analyst handles complex cases, identifies emerging threats, creates detection rules, and contributes to continuous improvement of IR processes, tools, and reporting.

Qualifications

• At least 4–5 years of relevant experience in Incident Response or Security Operations (L2/L3 level)
• Proven hands‑on experience across the full Incident Response lifecycle
• Demonstrated ability to analyze and respond to complex security incidents
• Experience in creating detection rules, correlation searches, and signatures to identify suspicious or malicious behavior
• Strong understanding of cybersecurity frameworks, malware behavior, attack vectors, and threat actor tactics (MITRE ATT&CK)
• Familiarity with SIEM, SOAR, EDR/XDR, network security tools, and endpoint forensic methods
• Excellent communication skills with the ability to clearly document and present findings
• Willingness to work shifting schedules, weekends, holidays, and overtime when required