Remote After-Hours Cybersecurity Incident Responder

Sourcefit; Quezon; Remote; PHP 4,447,000 - 6,353,000; Full time

Job summary

Sourcefit is seeking a Cybersecurity Engineer to support after-hours security operations, threat management, and incident response across customer environments in a fully remote role. The position emphasizes monitoring, investigation, and remediation using EDR platforms, with SentinelOne experience strongly preferred.

Ideal candidates will have 3+ years in cybersecurity, hands-on EDR and SIEM experience (Splunk, Microsoft Sentinel), and solid knowledge of Windows Server/AD.

Qualifications

• 3+ years in cybersecurity, incident response, SOC, or MDR.
• Hands-on experience with EDR platforms, including SentinelOne (preferred).
• Experience with SIEM solutions such as Splunk or Microsoft Sentinel.
• Working knowledge of Windows Server, Active Directory, and Microsoft 365 environments.
• Experience with PowerShell or automation tools is a plus.

Responsibilities

• Monitor, investigate, and respond to security alerts and incidents.
• Perform threat hunting, containment, eradication, and recovery activities.
• Analyze suspicious activity, malware, ransomware, and endpoint threats.
• Manage and remediate alerts generated by EDR, MDR, and SIEM platforms.
• Conduct root cause analysis and document findings.
• Perform remote troubleshooting and remediation of cybersecurity issues.
• Escalate complex incidents and coordinate with internal teams.
• Maintain incident documentation, remediation records, and security reports.
• Develop and maintain security procedures, runbooks, and operational documentation.
• Review customer environments and recommend security improvements.

Skills

Analytical thinking

Remote work

Communication skills

Incident response

Tools

SentinelOne

DNSFilter

Microsoft Defender for Endpoint

Splunk

Microsoft Sentinel

Job description

Sourcefit is seeking a Cybersecurity Engineer to support after-hours security operations, threat management, and incident response across customer environments in a fully remote role. The position emphasizes monitoring, investigation, and remediation using EDR platforms, with SentinelOne experience strongly preferred.

Ideal candidates will have 3+ years in cybersecurity, hands-on EDR and SIEM experience (Splunk, Microsoft Sentinel), and solid knowledge of Windows Server/AD.