Security Analyst

Vivmark Residential; Philippines; On-site; PHP 600,000 - 1,000,000; Full time

Job summary

Vivmark Residential is seeking a Security Analyst to join our Security Operations team. The analyst will support our production environment, protecting it from information security threats and executing documented threat management processes.

Focus on real-time security event analysis and working with SIEM, EDR, identity, and email security tools. You will triage alerts, manage incidents through containment and recovery, and develop detection rules and automation.

Qualifications

• 2+ years of experience as an Incident Responder or in Security Operations.
• Experience analyzing logs from cloud platforms (Microsoft 365, Entra ID, Azure) and endpoint security tools.
• Knowledge of MITRE ATT&CK framework and threat intel concepts.

Responsibilities

• Execute daily incident response processes and triage alerts from SIEM, EDR, identity, and email security tools.
• Manage the incident lifecycle from detection through containment, eradication, recovery and lessons learned.
• Investigate phishing reports and identity-based attacks; preserve artifacts for IR.
• Perform endpoint investigations using EDR telemetry and collect artifacts for IR.
• Author, test, and tune detection rules in the SIEM; reduce false positives and document detection logic mapped to MITRE ATT&CK.
• Build and maintain automation and SOAR playbooks to accelerate triage and enrichment.
• Convert threat intelligence feeds into actionable detections, blocks, and hunts.
• Conduct threat hunts across identity, cloud, and endpoint data sources.
• Participate in red team / blue team and tabletop exercises.
• Document investigations clearly and accurately; communicate status, findings and root cause to stakeholders.
• Prepare ad-hoc analysis and reports as needed.
• Participate in Security Operations on-call rotation.

Skills

Incident Response

Security Operations

SIEM analysis

EDR

Threat Hunting

Cloud Security

Tools

Splunk

Microsoft Defender for Endpoint

CrowdStrike

SentinelOne

Microsoft Entra ID

ProofPoint

Azure

Job description

As a key member of the Security Operations team, the Security Analyst supports our production environment, protecting it from the latest information security threats. The Analyst is responsible for executing documented cyber threat management processes. The Security Analyst will focus on real-time security event analysis to protect the organization's electronic assets. This position requires a strong and demonstrable passion for Information Security. Networking and prior IT experience is a must. Candidates must show willingness to learn, have strong self-directed work habits, demonstrate initiative, drive, creativity, self-assurance, and professionalism. Excellent teamwork skills are necessary.

TECHNOLOGY ENVIRONMENT:

• SIEM: Splunk (SPL) — search, dashboards, detection authoring and tuning
• Identity: Microsoft Entra ID / Microsoft 365, Entra ID Protection, Conditional Access
• Endpoint: EDR platform (e.g., Microsoft Defender for Endpoint, CrowdStrike, SentinelOne)
• Cloud: Microsoft Azure; exposure to AWS or other public cloud a plus
• Email security: ProofPoint, Microsoft Defender for Office 365 or equivalent secure email gateway

ESSENTIAL FUNCTIONS:

• Execute daily incident response processes and checklists; triage and investigate SIEM, EDR, identity, and email security alerts
• Manage the incident lifecycle from detection through containment, eradication, recovery, and lessons learned, in accordance with the security incident response policy
• Investigate phishing reports and identity-based attacks (credential theft, token replay, consent phishing, MFA fatigue, impossible travel)
• Perform endpoint investigations using EDR telemetry; collect and preserve artifacts in support of incident response
• Author, test, and tune detection rules in the SIEM; reduce false positives and document detection logic mapped to MITRE ATT&CK
• Build and maintain automation and SOAR playbooks to accelerate triage and enrichment
• Convert threat intelligence feeds into actionable detections, blocks, and hunts
• Conduct threat hunts across identity, cloud, and endpoint data sources based on hypotheses and current intelligence
• Participate in red team / blue team and tabletop exercises
• Document investigations clearly and accurately; communicate status, findings, and root cause to technical and non-technical stakeholders
• Prepare ad-hoc analysis and reports as needed
• Participate in the Security Operations on-call rotation
• Performs other duties as necessary

Represents the Company in a professional manner at all times. Consistently maintains a professional, courteous attitude when dealing with residents, coworkers, and the general public. The Company may revise this job description from time to time as business needs require. It is not intended to be an exhaustive listing of all the functions of the job, nor limit the Company’s right to assign other functions to an employee in this position. This job description does not constitute a written or implied contract of employment.

Technical skills requirements:

• 2+ years of experience as an Incident Responder and Security Operations
• Working understanding of common identity attack patterns: credential theft, token theft and replay, consent phishing, MFA fatigue / push bombing, and session hijacking
• Ability to read and analyze logs from cloud and SaaS platforms (Microsoft 365, Entra ID, Azure) and from endpoint security tools
• Phishing triage: header analysis, URL and attachment analysis, and user-reported email handling
• Endpoint investigation fundamentals: process trees, persistence mechanisms, lateral movement indicators
• Familiarity with the MITRE ATT&CK framework and its use in detection and investigation
• Basic scripting or query ability in at least one of: Python, PowerShell, KQL, SPL
• Fundamentals of TCP/IP, DNS, HTTP, and common network protocols sufficient to interpret network telemetry
• General familiarity with threat intelligence concepts and indicator handling

Must demonstrate strong analytical and problem solving skills. Ability to work independently with minimum supervision and handle multiple tasks simultaneously. Detail oriented, conscientious, thorough and accurate analysis. Process oriented with the ability to clarify objectives, evaluate options, consider implications, assess risks, and make key decisions. Excellent interpersonal and facilitation skills along with effective communication (both written and verbal) skills. Demonstrated ability to meet deadlines and commitments in an environment that requires multitasking among concurrent projects. Ability to convey security concepts and issues to both technical and non-technical audiences. Demonstrated ability to write with clarity and accuracy

Demonstrated interest (preferred):

• Home lab, detection lab, or personal SIEM/EDR project
• CTF, Hack The Box, TryHackMe, Blue Team Labs Online, or similar profiles
• Blog posts, investigation write-ups, or conference talks
• Certifications such as CompTIA Security+, BTL1, CySA+, GCIH, or SC-200 (preferred, not required)

Must demonstrate strong analytical and problem solving skills. Ability to work independently with minimum supervision and handle multiple tasks simultaneously. Detail oriented, conscientious, thorough and accurate analysis. Process oriented with the ability to clarify objectives, evaluate options, consider implications, assess risks, and make key decisions. Excellent interpersonal and facilitation skills along with effective communication (both written and verbal) skills. Demonstrated ability to meet deadlines and commitments in an environment that requires multitasking among concurrent projects. Ability to convey security concepts and issues to both technical and non-technical audiences. Demonstrated ability to write with clarity and accuracy

PHYSICAL AND VISUAL ACTIVITIES:

Ability to hear and speak well enough to converse verbally over the phone and in-person (expressing or exchanging ideas by means of the spoken or written word). Ability to interpret, evaluate and communicate detailed written or verbal instructions to others accurately and easily. Able to see well enough to use the computer effectively and read written communications.

The above describes the physical and visual activities that are commonly associated with the performance of the essential functions of this job. “Commonly associated” is not intended to mean always or only. Reasonable accommodation will be provided as required by law to enable otherwise qualified employees with a known disability to perform the essential functions of the job.