Remote Cyber Detection Engineer | Threat Hunting & SIEM

CyberOne; Metro Manila; Remote; PHP 700,000 - 1,000,000; Full time

Benefits offered by this job

Remote-first culture

Flexible working hours

Birthday off

Performance awards

Career development

Job summary

CyberOne is seeking a Detection Engineer to improve threat detection using Microsoft Sentinel SIEM. This remote, full-time role focuses on building and tuning detections, hunting queries, and working with clients to enhance security monitoring.

You’ll need hands-on SIEM experience, KQL skills, and familiarity with Defender XDR and Azure. A collaborative, security-first mindset is essential for success in CyberOne’s fast‑growing team.

Qualifications

• Hands-on experience with Microsoft Sentinel or another SIEM platform.
• Proficient in writing KQL queries for detection and investigation.
• Ability to translate threat intel into practical detections.

Responsibilities

• Develop, tune and maintain threat-led detections across Microsoft Sentinel, Defender XDR and the Microsoft Security ecosystem using KQL and Advanced Hunting.
• Perform threat intelligence-led detection engineering by researching emerging threats and translating findings into detections and response guidance.
• Build analytics rules, hunting queries, workbooks, automation logic and alert enrichment to improve detection and response outcomes.
• Collaborate with SecOps Engineers to optimise ingestion, parsing and data quality for better detections.
• Validate data connectors and telemetry coverage to ensure detections are reliable and actionable.

Skills

SIEM experience

KQL queries

Threat hunting basics

Scripting (PowerShell/Python)

Tools

Microsoft Defender

Azure

Entra ID

Microsoft 365 logs

Job description

CyberOne is seeking a Detection Engineer to improve threat detection using Microsoft Sentinel SIEM. This remote, full-time role focuses on building and tuning detections, hunting queries, and working with clients to enhance security monitoring.

You’ll need hands-on SIEM experience, KQL skills, and familiarity with Defender XDR and Azure. A collaborative, security-first mindset is essential for success in CyberOne’s fast‑growing team.