Security Analyst (SIEM)

VIATechnik

Makati

On-site

PHP 600,000 - 1,000,000

Full time

3 days ago

Be an early applicant

Get a reply from this employer

Your resume and cover letter, tailored to exactly what they’re hiring for.

Get past ATS filters

Job summary

VIATechnik is seeking a Blue Team Security Analyst in Manila. You will monitor security events, investigate threats, and strengthen our security posture across endpoints, networks, cloud, and identity services.

You will lead vulnerability assessments, coordinate remediation with IT teams, and document incidents with actionable recommendations. Collaboration with IT and security groups is essential for continuous security improvement.

Qualifications

Bachelor’s degree in IT, cybersecurity, CS, or related field or equivalent practical experience.
Minimum 3 years in Security Operations (SOC), Blue Team, incident investigation, vulnerability management, and security monitoring.
Hands-on experience with SIEM solutions or centralized log management.
Experience with vulnerability assessments and remediation tracking.
Strong understanding of Windows, Linux, Active Directory, Microsoft 365, Microsoft Entra ID, and IAM.
Knowledge of TCP/IP, DNS, HTTP/HTTPS, auth protocols, network security, and common attack techniques.
Ability to analyze logs across endpoints, networks, and identity systems.
Familiarity with MITRE ATT&CK and incident response methodologies.
Excellent analytical, troubleshooting, and communication skills.

Responsibilities

Monitor and analyze security events from SIEM, firewalls, endpoints, and cloud apps.
Investigate suspicious activities: logins, malware, privilege escalations, data transfers, IOCs.
Validate alerts, determine severity, impact, and required actions.
Correlate logs across systems to identify attack patterns and risks.
Improve detection rules and reduce false positives to increase visibility.
Conduct authorized vulnerability assessments and prioritize remediation.
Coordinate fixes with admins and technical teams.
Document findings, timelines, root causes, and remediation recommendations.
Prepare security reports and dashboards; maintain playbooks and SOPs.
Support incident response, containment, eradication, and post-incident reviews.

Skills

Security Operations (SOC)

Blue Team Operations

Incident Investigation

Vulnerability Management

Security Monitoring

SIEM

Windows

Linux

Active Directory

Microsoft 365

IAM

Education

Bachelor's Degree in Information Technology, Cybersecurity, Computer Science, or related field

Tools

SIEM platforms

Centralized log management

Microsoft Defender

Microsoft Sentinel

Fortinet Security Solutions

Splunk

Wazuh

Nessus

Qualys

Rapid7

Job description

Blue Team Security Analyst

Department: IT Infrastructure & Security
Reports To: IT Manager / Security Lead
Location: Manila, Philippines

About the Role

Are you passionate about cybersecurity and threat detection? We're looking for a Blue Team Security Analyst who can proactively monitor security events, investigate threats, identify vulnerabilities, and help strengthen our overall security posture.

In this role, you'll work across endpoints, networks, cloud services, and identity platforms to detect and respond to security incidents before they impact the business. You'll collaborate closely with IT teams to drive remediation efforts, improve security monitoring, and support a culture of continuous security improvement.

Key Responsibilities

Security Monitoring & Threat Detection

Monitor and analyze security events from SIEM platforms, firewalls, endpoint protection tools, identity systems, servers, and cloud applications.
Investigate suspicious activities including:
- Unauthorized login attempts
- Malware detections
- Privilege escalations
- Unusual network or data transfer activity
- Indicators of compromise (IOCs)
Validate alerts and determine severity, business impact, and required actions.
Correlate logs and events across multiple systems to identify attack patterns and security risks.
Improve detection rules, alert tuning, and monitoring coverage to reduce false positives and increase visibility.

Vulnerability Management

Conduct authorized vulnerability assessments across endpoints, servers, network devices, and business applications.
Review and validate scan results to eliminate false positives.
Prioritize vulnerabilities based on risk, exploitability, business impact, and asset criticality.
Coordinate remediation efforts with system administrators and technical teams.
Track identified vulnerabilities through resolution and verify fixes through follow-up assessments.
Review system configurations and recommend improvements to hardening, patch management, access controls, and endpoint security.

Incident Response

Triage and investigate cybersecurity incidents.
Assist with containment, eradication, recovery, and post-incident activities.
Preserve logs, evidence, and investigation records in accordance with company procedures.
Document findings, timelines, root causes, and remediation recommendations.
Escalate significant threats with clear impact assessments and actionable recommendations.
Support the refinement of incident response processes and procedures.

Security Reporting & Continuous Improvement

Prepare reports and dashboards covering:
- Security alerts
- Incident trends
- Vulnerability status
- Remediation progress
- Security gaps and recommendations
Maintain and improve security playbooks, standard operating procedures, and documentation.
Collaborate with IT teams and service providers to enhance logging, monitoring, and security controls.
Recommend security improvements based on emerging threats and lessons learned from investigations.
Participate in security awareness and continuous improvement initiatives.

Required Qualifications

Bachelor's Degree in Information Technology, Cybersecurity, Computer Science, or a related field, or equivalent practical experience.
Minimum 3 years of experience in:
- Security Operations (SOC)
- Blue Team Operations
- Incident Investigation
- Vulnerability Management
- Security Monitoring
Hands-on experience with SIEM solutions or centralized log management platforms.
Experience performing vulnerability assessments and tracking remediation efforts.
Strong understanding of:
- Windows and Linux operating systems
- Active Directory
- Microsoft 365
- Microsoft Entra ID
- Identity and Access Management (IAM)
Knowledge of:
- TCP/IP
- DNS
- HTTP/HTTPS
- Authentication protocols
- Network security concepts
- Common cyberattack techniques
Ability to analyze endpoint, network, identity, and application logs.
Familiarity with incident response methodologies and MITRE ATT&CK framework.
Strong analytical, troubleshooting, and communication skills.

Preferred Qualifications

Experience with:
- Microsoft Defender
- Microsoft Sentinel
- Fortinet Security Solutions
- Sophos
- Splunk
- Wazuh
Familiarity with:
- Microsoft Intune
- AWS
- UniFi Networking
- Synology NAS
Experience with vulnerability management tools such as:
- Nessus
- Qualys
- Rapid7
Basic scripting and automation skills using:
- PowerShell
- Python
- Bash
Relevant certifications such as:
- CompTIA Security+
- CySA+
- Blue Team Level 1 (BTL1)
- Microsoft SC-200
- Other cybersecurity certifications