Senior Associate Security Engineering

PDAX Access Channels. This limited; Pasig; On-site; PHP 600,000 - 1,000,000; Full time

Job summary

PDAX, a Philippine crypto exchange, seeks a security engineer to join our growing team in Manila. You will handle monitoring, alert triage, and assist in incident response while coordinating with MSOC partners.

You will help build detections, perform threat hunting, and contribute to automation across cloud and on‑prem environments. This role emphasizes drills and readiness for security incidents.

Qualifications

• Typically 2–4 years in security engineering, cloud security, or detection and response.
• AWS security: investigate CloudTrail events, GuardDuty, Security Hub and Inspector findings, and WAF logs.
• Incident response and threat hunting: investigate phishing, endpoint compromise, credential theft, and suspicious cloud activity.
• Detection engineering: build and tune SIEM/EDR detections, reduce false positives.
• Security automation and scripting: Python, JavaScript/TypeScript, or similar to automate investigations.
• Vulnerability management: assess exploitability and coordinate remediation across dependencies.
• Identity and application security: least privilege, SSO, MFA, secrets management, API security.
• Ownership and communication: explain findings and actions clearly to tech teams and management.

Responsibilities

• Monitor security alerts from SIEM, EDR/XDR, and cloud security tools.
• Perform initial alert triage and escalate to senior team members.
• Validate alerts from the MSOC provider.
• Assist senior engineers during security incidents (phishing, malware, account compromise).
• Collect logs, indicators of compromise (IOCs), and basic forensic data.
• Follow incident response playbooks and document actions taken.
• Support coordination with the MSOC provider; ensure tickets and escalations follow defined channels.
• Help track incident timelines, handoffs, and follow-ups between MSOC and internal teams.
• Maintain security monitoring coverage and log onboarding.
• Tune alerts to reduce false positives and verify critical systems are monitored.
• Assist in internal vulnerability assessments and basic attack simulations.
• Track findings from internal and external VAPT exercises; support remediation tracking.
• Document incident learnings, alerts, and recurring issues; participate in tabletop exercises.

Skills

AWS security

Incident response

Threat hunting

Detection engineering

Security automation

Vulnerability management

Identity and application security

Ownership and communication

Scripting

Tools

CrowdStrike

Wazuh

Trend Micro

JumpCloud

Job description

Job Description:

About PDAX

At PDAX, we believe that the future of money is digital, and our mission is to empower all Filipinos to grow their wealth through blockchain technology.

As one of the first crypto firms in the Philippine market, we feel a sense of duty to our users and to the ecosystem to set the standard for safety, ease of access, and reliability. We expect our team to share in this responsibility and cherish our vision of a more open and equitable financial system.

We are looking for new team members that are passionate about cryptocurrency, want to work in a disruptive, fast-growing industry, and thrive in a start‑up environment.

If this sounds like you, then we’d love to talk.

General Responsibilities

Security Monitoring & Alert Triage

• Monitor security alerts from SIEM, EDR/XDR, and cloud security tools
• Perform initial alert triage and elevate suspicious activity to senior team members
• Validate alerts from the Managed Security Operations (MSOC) provider

Incident Response Support

• Assist senior engineers during security incidents (phishing, malware, account compromise)
• Collect logs, indicators of compromise (IOCs), and basic forensic data
• Follow incident response playbooks and document actions taken

MSOC Coordination

• Support coordination with the Managed Security Operations (MSOC) provider
• Ensure alerts, tickets, and escalations follow defined communication channels
• Help track incident timelines, handoffs, and follow-ups between MSOC and internal teams

Defensive Operations & Posture Support

• Assist in maintaining security monitoring coverage and log onboarding
• Support tuning of alerts to reduce false positives
• Help verify that critical systems are properly monitored

VAPT & Attack Simulation Support

• Assist in internal vulnerability assessments and basic attack simulations
• Help track findings from internal and external VAPT exercises
• Support remediation tracking and retesting validation

Documentation & Readiness

• Help maintain incident response playbooks and runbooks
• Document incident learnings, alerts, and recurring issues
• Participate in tabletop exercises and security drills

Qualifications

• Relevant experience: Typically 2–4 years in security engineering, cloud security, or detection and response, with demonstrated ownership of investigations and security improvements.
• AWS security: Practical experience investigating CloudTrail events, GuardDuty alerts, Security Hub and Inspector findings, and WAF logs. Able to identify exposed services, excessive IAM permissions, and compromised credentials.
• Incident response and threat hunting: Able to investigate phishing, endpoint compromise, credential theft, and suspicious cloud activity; correlate evidence across systems, and execute containment and recovery.
• Detection engineering: Experience building and tuning SIEM/EDR detections, reducing false positives, identifying visibility gaps, and developing actionable response playbooks.
• Security automation and scripting: Proficiency in Python, JavaScript/TypeScript, or a comparable language to integrate APIs, enrich alerts, automate investigations, and reduce manual work.
• Vulnerability management: Able to assess exploitability and business impact, work with Engineering on remediation, and verify fixes across application dependencies, endpoints, and cloud infrastructure.
• Identity and application security: Working knowledge of least privilege, SSO, MFA, privileged access, secrets management, API authorization, and session security.
• Ownership and communication: Able to drive issues through resolution and explain findings, business impact, and recommended actions clearly to technical teams and management.

Preferred Qualifications

• Experience with CrowdStrike, Wazuh, Trend Micro, JumpCloud, or equivalent platforms.
• Experience integrating SAST, DAST, dependency scanning, and secrets scanning into CI/CD pipelines.
• Experience building AI-assisted security workflows, with evidence validation, controlled permissions, and human approval for consequential actions.

Our Culture

Communication

• We prioritize clear and transparent communication, ensuring that there is clarity among everyone we work with.
• We aim to have a collaborative environment, where innovative ideas in investment strategies are shared openly and constructively, driving the industry forward.

Customer-focus

• We think about how our decisions impact our customers and ensure we provide the best experience that we can.
• We believe in building lasting relationships with our clients, constantly learning from and listening to them, and always striving to look out for what’s best for both sides.

Commitment

• We always aim to do the right thing and to do the right thing, excellently. We take accountability seriously and uphold ourselves to high standards, ensuring that we execute with attention to detail.
• We are dedicated to the long‑term success of our clients in the dynamic world of financial technology, maintaining integrity and professionalism in every aspect of our work.

Requirements: