Remote Incident Response & Threat Hunting Specialist

CyberOne; Metro Manila; On-site; PHP 500,000 - 900,000; Full time

Job summary

CyberOne is seeking an Incident Response Specialist to support customers through all stages of cyber incidents, from investigation to containment, eradication, recovery, and post-incident reporting.

You will work with senior responders, analyze evidence across endpoints, networks, and cloud, and assist with proactive security services and threat hunting. Excellent English communication is essential.

Qualifications

• Relevant experience in Cyber Security or Incident Response.
• Strong English communication skills.

Responsibilities

• Investigate cyber security incidents affecting customer environments.
• Analyse endpoint, network, cloud and identity-based evidence.
• Perform host-based investigations across Windows and M365 environments.
• Support containment, eradication and recovery activities.
• Identify attacker tactics, techniques and procedures using the MITRE ATT&CK framework.
• Collect, preserve and analyse forensic artefacts where appropriate.
• Produce Indicators of Compromise and detection recommendations.
• Support evidence collection for regulatory or legal requirements.
• Analyse Microsoft Defender XDR telemetry.
• Investigate Microsoft Sentinel incidents.
• Review Windows Event Logs and Sysmon data.
• Analyse Entra ID sign-in and audit logs.
• Investigate Exchange Online activity.
• Perform malware triage and basic static analysis.
• Review firewall, proxy, VPN and authentication logs.
• Conduct threat hunting activities across customer environments.
• Participate in customer investigation calls.
• Explain technical findings to both technical and non-technical audiences.
• Produce high-quality investigation reports.
• Provide remediation recommendations.
• Support post-incident lessons learned workshops.
• Incident Response Readiness Assessments
• Tabletop Exercises
• Threat Hunting engagements
• Threat Intelligence services
• Security posture reviews
• AI security investigations where required
• Develop new investigation playbooks.
• Improve Incident Response procedures.
• Contribute to internal knowledge sharing.
• Support development of detection content.
• Assist with automation opportunities using Microsoft and AI technologies.

Skills

Cyber Security

Incident Response

English Communication

Education

Bachelor's degree in CS/IT or related

Tools

Microsoft Defender XDR

Microsoft Sentinel

Entra ID logs

Job description

CyberOne is seeking an Incident Response Specialist to support customers through all stages of cyber incidents, from investigation to containment, eradication, recovery, and post-incident reporting.

You will work with senior responders, analyze evidence across endpoints, networks, and cloud, and assist with proactive security services and threat hunting. Excellent English communication is essential.