Senior Cyber Security Engineer

GoTyme Bank Corporation; Quezon City; Hybrid; PHP 900,000 - 1,800,000; Full time

Job summary

GoTyme Bank Corporation seeks a Senior Cyber Security Engineer in Manila to mature security engineering and operations. You will own endpoint, enterprise, identity and cloud security for Windows, macOS, and mobile devices, driving detections, automation, and remediation with IT and Cloud teams.

You will mentor junior engineers, maintain operational docs, support BSP regulatory compliance, and contribute to the Security Engineering Centre of Excellence within the GoTyme Group.

Qualifications

• Six to ten years of hands-on cybersecurity engineering, enterprise security or security operations.
• Experience independently designing, deploying, managing and improving production security controls.
• Strong experience in endpoint and mobile security including Microsoft Intune, Entra ID and Defender.
• Hands-on knowledge of DLP, CASB, email security, DNS security and secure web access controls.
• Proficient in incident investigation and response, SIEM detection engineering, vulnerability management and AWS security.
• Strong scripting skills (PowerShell, Bash) with working knowledge of Python and REST APIs for automation.

Responsibilities

• Design, deploy, manage and improve production security controls.
• Mentor junior engineers and collaborate with IT, SOC, MSPs and cloud teams.
• Maintain endpoint and device security, including MFA and privileged access controls.
• Implement and validate AWS security controls and cloud findings.
• Lead incident response, containment, recovery, and root-cause analysis.
• Develop detections and automation, and tune SIEM searches and rules.

Skills

Microsoft Intune

Entra ID

Defender

PowerShell

Bash

Python

REST APIs

Education

Degree in Cybersecurity/CS/IT or related field

Relevant certifications (advantage)

Tools

SIEM

Job description

GoTyme is a joint venture between the Gokongwei Group, one of the biggest conglomerates in the Philippines, and the Singapore-headquartered digital banking group Tyme. This venture combines the trusted Gokongwei brand, customer base, and distribution ecosystem with Tyme's globally proven digital banking technology and hands-on experience building South Africa's leading digital bank, TymeBank, one of the fastest-growing digital banks in the world today.

At GoTyme, we have embarked on a journey to democratize financial services and bring next-level banking to the Philippines. We seek individuals who share our belief that the game is worth changing, to join our growing team of GoTymers as we build, launch, and scale a bank that empowers all Filipinos to navigate a path to financial freedom.

About the role

We are seeking a Senior Cyber Security Engineer to strengthen and mature security engineering and operations in the Philippines. This hands-on role covers endpoint, enterprise, identity and cloud security, protecting Windows, macOS and mobile devices. The role contributes to the Cyber Engineering Centre of Excellence for the GoTyme Group and supports BSP regulatory compliance.

The engineer will own assigned security platforms, respond to SOC escalations, develop detections and automation, and drive remediation with IT and Cloud teams. The successful candidate will work independently from the outset, maintain operational documentation and mentor junior engineers.

Endpoint and device security

• Design, deploy, configure and maintain endpoint protection agents and policies across Windows, macOS and mobile devices.
• Build device management packages and detection and remediation scripts. Manage pilot rollouts, upgrades and rollback with IT.
• Manage device compliance and security enforcement through endpoint management platforms. Reconcile inventories, close coverage gaps with IT, and verify agent health and policy enforcement.
• Engineer and maintain endpoint hardening baselines and encryption controls, monitor configuration drift and validate remediation.
• Design, deploy and tune endpoint data loss prevention (DLP) and Cloud Access Security Broker (CASB) controls with managed service providers to protect sensitive and regulated data.
• Troubleshoot DLP deployments and upgrades across operating systems and secure access controls.
• Investigate potential data loss, reduce false positives, manage user coaching and document policy exceptions for approval by the appropriate owner.
• Validate protection of sensitive data across endpoints and cloud applications, and provide control evidence and reporting for risk and regulatory purposes.
• Engineer, operate and improve email, DNS, web security and zero trust access controls, including policy design, tuning and troubleshooting.
• Evaluate security capabilities through technical testing and contribute to security design reviews, enterprise security architecture and operational readiness.

Identity and privileged access

• Maintain MFA, Conditional Access and privileged identity controls with IT, including role scoping and time-bound access.
• Investigate identity alerts and excessive privileges, enforce least privilege and remediate access weaknesses with accountable owners.

Cloud security engineering

• Implement and validate agreed AWS security controls with Cloud teams, including identity and access management, audit logging and threat detection.
• Investigate cloud findings and support secure configuration reviews and remediation, documenting changes and operational ownership.

Security operations and incident response

• Investigate SOC escalations and execute authorised containment actions in line with agreed response procedures.
• Support incident scoping, evidence preservation, recovery, root-cause analysis and improvement actions, working with the managed SOC and incident response specialists.
• Perform daily checks of platform health, coverage and telemetry delivery. Resolve failures and elevate material gaps.

Detection engineering and automation

• Develop and tune SIEM searches, correlation rules and use cases with the SOC, using endpoint, identity, email and cloud telemetry mapped to MITRE ATT&CK. Provide feedback to improve alert quality.
• Build scripts and API integrations (for example PowerShell, Bash and Python) for control checks, reconciliation and reporting, with sound change control and testing.
• Apply a threat-led approach, using threat intelligence and targeted threat hunting to validate detection coverage and improve preventive controls.

Vulnerability management and remediation

• Work with the relevant teams to operate and improve vulnerability management, including coverage, prioritisation by exploitability and business impact, and scan troubleshooting.
• Track vulnerability and penetration test findings with IT, Cloud and application owners through retesting and verified closure. Escalate overdue critical and high risks.

Compliance and governance

• Support compliance with Bangko Sentral ng Pilipinas (BSP) cybersecurity and technology risk requirements by maintaining technical control evidence, supporting audits and examinations, and tracking remediation of findings to closure.
• Maintain control evidence for Group audits and applicable frameworks, including PCI DSS, ISO 27001 and Data Privacy Act obligations.
• Maintain security standards and operational runbooks with tested recovery procedures. Keep ownership, exceptions and unresolved risks current.

Collaboration and mentoring

• Mentor junior engineers, share investigation and engineering knowledge, and provide documented cover for assigned services.
• Coordinate with IT, the SOC, managed service providers, Cloud Operations and Cloud/Application Security teams, and with Group engineering colleagues in other regions. Deliver agreed changes and remediation within assigned responsibilities.

Requirements

• 6-10 years of hands-on experience in cybersecurity engineering, enterprise security or security operations.
• Proven ability to independently design, deploy, manage and improve production security controls.
• Strong experience in endpoint and mobile security, including Microsoft Intune, Entra ID and Defender.
• Hands-on knowledge of DLP, CASB, email security, DNS security and secure web access controls.
• Practical skills in incident investigation and response, SIEM detection engineering, vulnerability management and AWS security.
• Strong PowerShell and Bash scripting skills, working knowledge of Python, and experience using REST APIs for automation.
• Experience translating security standards and audit requirements into operational controls, ideally within regulated financial services and BSP requirements.
• Collaborative, accountable and calm under pressure, with clear communication skills and a willingness to mentor junior engineers.
• Degree in Cybersecurity, Computer Science, IT or a related field, or equivalent practical experience. Relevant certifications are an advantage.
• Based in Manila with hybrid working, regional collaboration and participation in an agreed on-call rotation.