Security Analyst, InfoSec

Kroll; Philippines; On-site; PHP 1,200,000 - 2,400,000; Full time

Job summary

Kroll is seeking a Threat Hunter to proactively identify advanced cyber threats within organizational networks. You will conduct hypothesis-driven investigations to uncover hidden adversaries and mitigate risks.

In this role you will analyze logs, network traffic, endpoints, and telemetry using tools like SIEM, EDR, and custom scripts. You will document findings and collaborate with detection engineering to automate responses.

Qualifications

• Bachelor's degree in Cybersecurity, CS, or related field; advanced certs preferred.

Responsibilities

• Develop and test hypotheses based on threat intelligence, anomalies, and attack patterns to proactively hunt for malicious activity.
• Analyze logs, network traffic, endpoints, and telemetry data using tools like SIEM, EDR, and custom scripts to correlate events and detect stealthy attacks.
• Document findings, create repeatable hunt playbooks, and collaborate with detection engineering to automate responses and improve defenses.
• Research emerging threats, malware, and TTPs (tactics, techniques, procedures); generate reports and recommend mitigations.
• Conduct threat hunting campaigns, assess vulnerabilities, and support incident response while optimizing hunting tools and processes.

Skills

Threat hunting

Incident response

SOC operations

Analytical skills

Education

Bachelor's degree in Cybersecurity/CS or related field

GCTI/CTIA/OSCP preferred

Tools

CrowdStrike Falcon

Splunk

Wireshark

YARA

Python

Job description

A Threat Hunter proactively identifies advanced cyber threats within organizational networks that evade traditional detection tools. This role involves hypothesis-driven investigations to uncover hidden adversaries, mitigate risks, and enhance SOC capabilities.

Key Responsibilities

• Develop and test hypotheses based on threat intelligence, anomalies, and attack patterns to proactively hunt for malicious activity.
• Analyze logs, network traffic, endpoints, and telemetry data using tools like SIEM, EDR, and custom scripts to correlate events and detect stealthy attacks.
• Document findings, create repeatable hunt playbooks, and collaborate with detection engineering to automate responses and improve defenses.
• Research emerging threats, malware, and TTPs (tactics, techniques, procedures); generate reports and recommend mitigations.
• Conduct threat hunting campaigns, assess vulnerabilities, and support incident response while optimizing hunting tools and processes.

Required Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, or related field; advanced certifications like GCTI, CTIA, or OSCP preferred.
• 5+ years in cybersecurity, with hands-on experience in SOC, incident response, and threat hunting.
• Proficiency in tools such as CrowdStrike Falcon, Splunk, Wireshark, YARA, and Python for scripting and automation.
• Strong analytical skills, knowledge of MITRE ATT&CK framework, and understanding of cloud/network security.

Kroll is committed to equal opportunity and diversity, and recruits people based on merit.