Security Analyst (SIEM)

Viatechnik Inc.; Makati; On-site; PHP 480,000 - 660,000; Full time

Job summary

VIATechnik Inc. seeks a Blue Team Security Analyst in Manila to monitor security events, investigate threats, and strengthen our security posture across endpoints, networks, and cloud services.

The role covers vulnerability management, incident response, and continuous improvement of logging, monitoring, and security controls, collaborating with IT teams to remediate and enhance detections.

Qualifications

• Bachelor's degree or equivalent practical experience in IT/cybersecurity.
• Minimum 3 years in Security Operations, Blue Team, Incident Investigation, Vulnerability Management, and Security Monitoring.
• Hands-on experience with SIEM platforms or centralized log management.

Responsibilities

• Monitor security events from SIEM, firewalls, endpoints, identity systems, servers and cloud apps.
• Investigate suspicious activities including unauthorized logins, malware detections, privilege escalations, unusual data transfers, and IOCs.
• Validate alerts, determine severity and required actions; correlate logs to identify attack patterns.
• Lead vulnerability assessments, prioritize fixes by risk, coordinate remediation with IT teams.
• Triage incidents, assist containment and recovery, document findings and recommendations.

Skills

SecurityOps

Blue Team

Incident Investigation

Vulnerability Mgmt

SecurityMonitoring

SIEM

Windows & Linux

Active Directory

Microsoft 365 & Entra ID

IAM

TCP/IP & DNS

MITRE ATT&CK

Education

Bachelor's Degree (IT/Cybersecurity/CS)

Tools

SIEM

Nessus

Qualys

Rapid7

Splunk

Job description

Blue Team Security Analyst

Department: IT Infrastructure & Security
Reports To: IT Manager / Security Lead
Location: Manila, Philippines

About the Role

Are you passionate about cybersecurity and threat detection? We're looking for a Blue Team Security Analyst who can proactively monitor security events, investigate threats, identify vulnerabilities, and help strengthen our overall security posture.

In this role, you'll work across endpoints, networks, cloud services, and identity platforms to detect and respond to security incidents before they impact the business. You'll collaborate closely with IT teams to drive remediation efforts, improve security monitoring, and support a culture of continuous security improvement.

Key Responsibilities

Security Monitoring & Threat Detection

• Monitor and analyze security events from SIEM platforms, firewalls, endpoint protection tools, identity systems, servers, and cloud applications.

• Investigate suspicious activities including:

  • Unauthorized login attempts

  • Malware detections

  • Privilege escalations

  • Unusual network or data transfer activity

  • Indicators of compromise (IOCs)

• Validate alerts and determine severity, business impact, and required actions.

• Correlate logs and events across multiple systems to identify attack patterns and security risks.

• Improve detection rules, alert tuning, and monitoring coverage to reduce false positives and increase visibility.

Vulnerability Management

• Conduct authorized vulnerability assessments across endpoints, servers, network devices, and business applications.

• Review and validate scan results to eliminate false positives.

• Prioritize vulnerabilities based on risk, exploitability, business impact, and asset criticality.

• Coordinate remediation efforts with system administrators and technical teams.

• Track identified vulnerabilities through resolution and verify fixes through follow-up assessments.

• Review system configurations and recommend improvements to hardening, patch management, access controls, and endpoint security.

Incident Response

• Triage and investigate cybersecurity incidents.

• Assist with containment, eradication, recovery, and post-incident activities.

• Preserve logs, evidence, and investigation records in accordance with company procedures.

• Document findings, timelines, root causes, and remediation recommendations.

• Escalate significant threats with clear impact assessments and actionable recommendations.

• Support the refinement of incident response processes and procedures.

Security Reporting & Continuous Improvement

• Prepare reports and dashboards covering:

  • Security alerts

  • Incident trends

  • Vulnerability status

  • Remediation progress

  • Security gaps and recommendations

• Maintain and improve security playbooks, standard operating procedures, and documentation.

• Collaborate with IT teams and service providers to enhance logging, monitoring, and security controls.

• Recommend security improvements based on emerging threats and lessons learned from investigations.

• Participate in security awareness and continuous improvement initiatives.

Required Qualifications

• Bachelor's Degree in Information Technology, Cybersecurity, Computer Science, or a related field, or equivalent practical experience.

• Minimum 3 years of experience in:

  • Security Operations (SOC)

  • Blue Team Operations

  • Incident Investigation

  • Vulnerability Management

  • Security Monitoring

• Hands-on experience with SIEM solutions or centralized log management platforms.

• Experience performing vulnerability assessments and tracking remediation efforts.

• Strong understanding of:

  • Windows and Linux operating systems

  • Active Directory

  • Microsoft 365

  • Microsoft Entra ID

  • Identity and Access Management (IAM)

• Knowledge of:

  • TCP/IP

  • DNS

  • HTTP/HTTPS

  • Authentication protocols

  • Network security concepts

  • Common cyberattack techniques

• Ability to analyze endpoint, network, identity, and application logs.

• Familiarity with incident response methodologies and MITRE ATT&CK framework.

• Strong analytical, troubleshooting, and communication skills.

Preferred Qualifications

• Experience with:

  • Microsoft Defender

  • Microsoft Sentinel

  • Fortinet Security Solutions

  • Sophos

  • Splunk

  • Wazuh

• Familiarity with:

  • Microsoft Intune

  • AWS

  • UniFi Networking

  • Synology NAS

• Experience with vulnerability management tools such as:

  • Nessus

  • Qualys

  • Rapid7

• Basic scripting and automation skills using:

  • PowerShell

  • Python

  • Bash

• Relevant certifications such as:

  • CompTIA Security+

  • CySA+

  • Blue Team Level 1 (BTL1)

  • Microsoft SC-200

  • Other cybersecurity certifications

What Success Looks Like

• Security threats and alerts are investigated and escalated within defined response times

• Vulnerabilities are accurately prioritized and remediated within target timelines

• Security incidents are thoroughly documented with actionable recommendations

• Monitoring effectiveness improves while false positives are reduced

• Security controls, visibility, and detection capabilities continuously mature

• Strong collaboration with IT teams to improve overall security posture

Why Join Us?

• Protect critical business systems and data

• Investigate real-world threats and security incidents

• Work with modern security, cloud, and identity platforms

• Grow your cybersecurity expertise through continuous learning

• Collaborate with experienced IT and security professionals

• Build your career in a fast-growing and security-focused environment

Be on the front lines of cybersecurity and help keep our organization secure.