Security Analyst SIEM

VIATechnik; Makati; Presencial; PHP 700.000 - 1.200.000; Jornada completa

Descripción de la vacante

VIATechnik is seeking a Blue Team Security Analyst to monitor security events, investigate threats, and strengthen our security posture in Manila. You will work across endpoints, networks, cloud services, and identity platforms to detect and respond to incidents before they impact the business.

You will collaborate with IT teams to drive remediation, improve detection rules, and support continuous security improvement while following MITRE ATT&CK guidelines and industry best practices.

Formación

• Bachelor's degree or equivalent practical experience.
• Minimum 3 years in Security Operations (SOC), Blue Team, incident investigations or vulnerability management.
• Hands-on with SIEM and centralized log management platforms.
• Experience performing vulnerability assessments and remediation tracking.
• Strong understanding of Windows, Linux, AD, Microsoft 365, IAM.

Responsabilidades

• Monitor and analyze security events from SIEM, firewalls, endpoints, cloud apps.
• Investigate and triage security incidents, escalate with impact assessments.
• Conduct authorized vulnerability assessments and prioritize fixes.
• Coordinate remediation with sysadmins and IT teams.
• Prepare security reports, dashboards, and remediation progress updates.
• Maintain playbooks and improve logging, monitoring, and controls.

Conocimientos

Security Operations

Blue Team

Incident Investigation

Vulnerability Management

Security Monitoring

SIEM

Windows

Linux

IAM

MITRE ATT&CK

Educación

Bachelor's Degree in IT / Cybersecurity / CS

Herramientas

Microsoft Defender

Microsoft Sentinel

Fortinet

Sophos

Splunk

Wazuh

Microsoft Intune

AWS

UniFi

Synology NAS

Nessus

Qualys

Rapid7

PowerShell

Python

Bash

Descripción del empleo

Job Description

Blue Team Security Analyst

• Department: IT Infrastructure & Security
• Reports To: IT Manager / Security Lead
• Location: Manila, Philippines

About the Role

Are you passionate about cybersecurity and threat detection? We’re looking for a Blue Team Security Analyst who can proactively monitor security events, investigate threats, identify vulnerabilities, and help strengthen our overall security posture.

In this role, you’ll work across endpoints, networks, cloud services, and identity platforms to detect and respond to security incidents before they impact the business. You’ll collaborate closely with IT teams to drive remediation efforts, improve security monitoring, and support a culture of continuous security improvement.

Key Responsibilities

Security Monitoring & Threat Detection

• Monitor and analyze security events from SIEM platforms, firewalls, endpoint protection tools, identity systems, servers, and cloud applications.
• Investigate suspicious activities including:
  • Unauthorized login attempts
  • Malware detections
  • Privilege escalations
  • Unusual network or data transfer activity
  • Indicators of compromise (IOCs)
• Validate alerts and determine severity, business impact, and required actions.
• Correlate logs and events across multiple systems to identify attack patterns and security risks.
• Improve detection rules, alert tuning, and monitoring coverage to reduce false positives and increase visibility.

Vulnerability Management

• Conduct authorized vulnerability assessments across endpoints, servers, network devices, and business applications.
• Review and validate scan results to eliminate false positives.
• Prioritize vulnerabilities based on risk, exploitability, business impact, and asset criticality.
• Coordinate remediation efforts with system administrators and technical teams.
• Track identified vulnerabilities through resolution and verify fixes through follow-up assessments.
• Review system configurations and recommend improvements to hardening, patch management, access controls, and endpoint security.

Incident Response

• Triage and investigate cybersecurity incidents.
• Assist with containment, eradication, recovery, and post-incident activities.
• Preserve logs, evidence, and investigation records in accordance with company procedures.
• Document findings, timelines, root causes, and remediation recommendations.
• Escalate significant threats with clear impact assessments and actionable recommendations.
• Support the refinement of incident response processes and procedures.

Security Reporting & Continuous Improvement

• Prepare reports and dashboards covering:
  • Security alerts
  • Incident trends
  • Vulnerability status
  • Remediation progress
  • Security gaps and recommendations
• Maintain and improve security playbooks, standard operating procedures, and documentation.
• Collaborate with IT teams and service providers to enhance logging, monitoring, and security controls.
• Recommend security improvements based on emerging threats and lessons learned from investigations.
• Participate in security awareness and continuous improvement initiatives.

Required Qualifications

• Bachelors Degree in Information Technology, Cybersecurity, Computer Science, or a related field, or equivalent practical experience.
• Minimum 3 years of experience in:
  • Security Operations (SOC)
  • Blue Team Operations
  • Incident Investigation
  • Vulnerability Management
  • Security Monitoring
• Hands‑on experience with SIEM solutions or centralized log management platforms.
• Experience performing vulnerability assessments and tracking remediation efforts.
• Strong understanding of:
  • Windows and Linux operating systems
  • Active Directory
  • Microsoft 365
  • Microsoft Entra ID
  • Identity and Access Management (IAM)
• Knowledge of:
  • TCP/IP
  • DNS
  • HTTP/HTTPS
  • Authentication protocols
  • Network security concepts
  • Common cyberattack techniques
• Ability to analyze endpoint, network, identity, and application logs.
• Familiarity with incident response methodologies and MITRE ATT&CK framework.
• Strong analytical, troubleshooting, and communication skills.

Preferred Qualifications

• Experience with:
  • Microsoft Defender
  • Microsoft Sentinel
  • Fortinet Security Solutions
  • Sophos
  • Splunk
  • Wazuh
• Familiarity with:
  • Microsoft Intune
  • AWS
  • UniFi Networking
  • Synology NAS
• Experience with vulnerability management tools such as:
  • Nessus
  • Qualys
  • Rapid7
• Basic scripting and automation skills using:
  • PowerShell
  • Python
  • Bash
• Relevant certifications such as:
  • CompTIA Security+
  • CySA+
  • Blue Team Level 1 (BTL1)
  • Microsoft SC-200
  • Other cybersecurity certifications

What Success Looks Like

Security threats and alerts are investigated and escalated within defined response times

Vulnerabilities are accurately prioritized and remediated within target timelines

Security incidents are thoroughly documented with actionable recommendations

Monitoring effectiveness improves while false positives are reduced

Security controls, visibility, and detection capabilities continuously mature

Strong collaboration with IT teams to improve overall security posture

Why Join Us?

Protect critical business systems and data

Investigate real-world threats and security incidents

Work with modern security, cloud, and identity platforms

Grow your cybersecurity expertise through continuous learning

Collaborate with experienced IT and security professionals

Build your career in a fast-growing and security-focused environment

Be on the front lines of cybersecurity and help keep our organization secure.