Security Engineer (SIEM & SOAR)

Metacom Careers; Quezon City; On-site; PHP 600,000 - 900,000; Full time

Job summary

Metacom Careers is seeking an experienced SIEM/SOAR engineer to design, implement, and optimize security operations across cloud, on‑prem, and hybrid environments. You will develop correlations, dashboards, and automations, and collaborate with SOC analysts to improve threat visibility and drive faster investigations.

The role requires hands‑on SIEM/SOAR work, SOC experience, and a relevant degree. You will work with familiar platforms like Splunk, Microsoft Sentinel, QRadar, and Cortex XSOAR in

Qualifications

• 3–8 years of cybersecurity experience, with strong hands‑on experience in SIEM and/or SOAR engineering.
• Experience working in a Security Operations Center (SOC) environment is highly preferred.
• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field.

Responsibilities

• Design, implement, and optimize SIEM solutions (Splunk, Microsoft Sentinel, Google SecOps, QRadar, ArcSight).
• Develop and enhance correlation rules, dashboards, alerts, and reports to improve threat visibility.
• Integrate security telemetry from cloud, endpoints, networks, and applications and improve data ingestion and parsing.
• Build and maintain automated incident response playbooks using Cortex XSOAR, Splunk SOAR, or IBM Resilient.
• Automate alert triage, threat intelligence enrichment, and response actions; collaborate with SOC analysts and threat hunters to streamline investigations.
• Integrate SOAR platforms with ticketing systems, threat feeds, and security controls.
• Provide incident response support through actionable detections and automation-driven insights; perform root cause analysis and collaborate with compliance.

Skills

SIEM engineering

SOAR engineering

SOC experience

Python scripting

PowerShell scripting

Education

Bachelor's degree in CS/IT/Cybersecurity

Tools

Splunk

Microsoft Sentinel

QRadar

ArcSight

Google SecOps

Cortex XSOAR

IBM Resilient

MITRE ATT&CK

Job description

What You\'ll Do

SIEM Engineering

• Design, implement, and optimize SIEM solutions such as Splunk, Microsoft Sentinel, Google

SecOps, QRadar, and Elastic.

• Develop and enhance correlation rules, dashboards, alerts, and reports to improve threat visibility.
• Integrate security telemetry from cloud, endpoints, networks, and applications.
• Improve data ingestion, normalization, and parsing to increase detection accuracy and reduce

noise.

SOAR & Security Automation

• Build and maintain automated incident response playbooks using platforms such as Cortex XSOAR,

Splunk SOAR, or IBM Resilient.

• Automate alert triage, threat intelligence enrichment, and response actions.
• Partner with SOC analysts and threat hunters to streamline investigations and reduce response

times.

• Integrate SOAR platforms with ticketing systems, threat feeds, and security controls.

Security Operations Support

• Support incident response through actionable detections and automation-driven insights.
• Perform root cause analysis and develop engineering solutions to address recurring threats.
• Collaborate with compliance and audit teams to strengthen security controls.
• Create documentation and provide enablement sessions for SOC and IT teams.

Required Experience

What We\'re Looking For

• 3–8 years of cybersecurity experience, with strong hands‑on experience in SIEM and/or SOAR engineering.
• Experience working in a Security Operations Center (SOC) environment is highly preferred.
• Bachelor\'s degree in Computer Science, Information Technology, Cybersecurity, or a related field.

Technical Skills

• Hands‑on experience with at least one SIEM platform:
• Splunk
• Microsoft Sentinel
• Google SecOps
• QRadar
• ArcSight
• Experience developing SOAR playbooks, workflows, and security automations.
• Scripting and automation skills using Python, PowerShell, or Bash.
• Knowledge of MITRE ATT&CK, NIST, CIS Controls, or similar cybersecurity frameworks.
• Familiarity with EDR/XDR, IDS/IPS, firewall technologies, and cloud security (AWS, Azure, or GCP).