Remote Cyber Detection Engineer

CyberOne; Philippines; Remote; PHP 900,000 - 1,200,000; Full time

Job summary

CyberOne is hiring a Cyber Detection Engineer focused on Microsoft Sentinel SIEM to strengthen threat detection and monitoring for clients. You will write, tune, and maintain detections, collaborating with SOC analysts and engineers to turn threat intelligence into practical detection content.

The role emphasizes hands-on work with Microsoft security tooling, threat hunting, and automation, in a remote-first environment.

Qualifications

• Hands-on experience with Microsoft Sentinel or another SIEM platform.
• Experience writing KQL queries for detection, investigation or reporting.
• Understanding of Microsoft Defender products (Defender for Endpoint, Defender for Office 365, Defender for Cloud, Defender for Identity).
• Familiarity with Azure, Entra ID, Microsoft 365 and common cloud security log sources.
• Knowledge of security monitoring concepts, alert logic, false positive tuning, and detection lifecycle management.
• Interest in attacker behaviours, persistence techniques, lateral movement, credential abuse and cloud attack paths.
• Awareness of frameworks such as MITRE ATT&CK, Cyber Kill Chain or similar.
• Ability to document technical work clearly and explain detection logic to technical and non-technical audiences.
• Basic scripting or automation skills (PowerShell, Python, Logic Apps).
• Collaborative mindset and willingness to work with analysts, engineers, consultants, and clients.

Responsibilities

• Develop, tune, and maintain threat-led detections across Microsoft Defender XDR and the Microsoft Security ecosystem using KQL and Advanced Hunting.
• Research emerging threats and attacker techniques; translate findings into practical detections, hunting queries and response guidance.
• Build analytics rules, hunting queries, workbooks, automation logic, and alert enrichment.
• Collaborate with SecOps Engineers to optimise data connectors, parsing, normalisation and ingestion.
• Validate data connectors and telemetry coverage to ensure reliable detections for clients.
• Map detections to attacker behaviours and MITRE ATT&CK techniques.
• Reduce false positives through tuning, baselining and SOC feedback.
• Develop reusable detection content, playbooks, and templates.
• Collaborate with SOC analysts to improve triage and investigation workflows.
• Produce clear documentation for detections, data requirements, and response guidance.

Skills

Microsoft Sentinel

KQL

Threat hunting

Automation

Python

PowerShell

Tools

Azure

Logic Apps

Terraform

Git

Job description

CyberOne is hiring a Cyber Detection Engineer focused on Microsoft Sentinel SIEM to strengthen threat detection and monitoring for clients. You will write, tune, and maintain detections, collaborating with SOC analysts and engineers to turn threat intelligence into practical detection content.

The role emphasizes hands-on work with Microsoft security tooling, threat hunting, and automation, in a remote-first environment.