Security Analyst, InfoSec

Kroll; Manila; On-site; PHP 1,200,000 - 2,400,000; Full time

Job summary

Kroll is seeking a Threat Hunter in Manila to proactively detect advanced cyber threats and improve SOC capabilities. You will formulate hypotheses from threat intelligence and run analytics across logs, networks, and endpoints to reveal hidden adversaries.

The role requires 5+ years of cybersecurity experience, proficiency with CrowdStrike, Splunk, Wireshark, YARA, and Python, and knowledge of MITRE ATT&CK. Strong communication and teamwork are essential.

Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, or related field.
• Advanced certifications like GCTI, CTIA, or OSCP preferred.
• 5+ years in cybersecurity with hands-on experience in SOC, IR, and threat hunting.
• Proficiency with CrowdStrike Falcon, Splunk, Wireshark, YARA, and Python for scripting/automation.
• Strong analytical skills and knowledge of MITRE ATT&CK framework.

Responsibilities

• Develop and test hypotheses from threat intel, anomalies, and attack patterns to hunt for malicious activity.
• Analyze logs, network traffic, endpoints, and telemetry using SIEM/EDR and custom scripts to detect stealthy attacks.
• Document findings, create repeatable hunt playbooks, and collaborate with detection engineering to automate responses.
• Research emerging threats, malware, and TTPs; generate reports and mitigations.
• Conduct threat hunting campaigns, assess vulnerabilities, and support incident response while refining tools and processes.

Skills

Threat hunting

Incident response

Analytical skills

MITRE ATT&CK

Education

Bachelor's degree in Cybersecurity/CS

Advanced security certifications (GCTI/CTIA/OSCP)

Tools

CrowdStrike Falcon

Splunk

Wireshark

YARA

Python scripting

Job description

A Threat Hunter proactively identifies advanced cyber threats within organizational networks that evade traditional detection tools. This role involves hypothesis-driven investigations to uncover hidden adversaries, mitigate risks, and enhance SOC capabilities.

Key Responsibilities:

Develop and test hypotheses based on threat intelligence, anomalies, and attack patterns to proactively hunt for malicious activity.

Analyze logs, network traffic, endpoints, and telemetry data using tools like SIEM, EDR, and custom scripts to correlate events and detect stealthy attacks.

Document findings, create repeatable hunt playbooks, and collaborate with detection engineering to automate responses and improve defenses.

Research emerging threats, malware, and TTPs (tactics, techniques, procedures); generate reports and recommend mitigations.

Conduct threat hunting campaigns, assess vulnerabilities, and support incident response while optimizing hunting tools and processes.

Required Qualifications:

Bachelor's degree in Cybersecurity, Computer Science, or related field; advanced certifications like GCTI, CTIA, or OSCP preferred.

5+ years in cybersecurity, with hands-on experience in SOC, incident response, and threat hunting.

Proficiency in tools such as CrowdStrike Falcon, Splunk, Wireshark, YARA, and Python for scripting and automation.

Strong analytical skills, knowledge of MITRE ATT&CK framework, and understanding of cloud/network security.

Kroll is committed to equal opportunity and diversity, and recruits people based on merit.