Senior Cybersecurity Engineer, Defense Operations

Motional; Santo Niño 1st; On-site; PHP 2,513,000 - 4,397,000; Full time

Job summary

Motional is seeking a senior cybersecurity operations professional to serve as a frontline incident responder and security operations expert. You will manage detection through eradication, partner with our MDR provider, and optimize SIEM/EDR, cloud security, and vulnerability management across the APAC region.

You will analyze alerts and logs, investigate incidents under NIST/ISO frameworks, and contribute to automation through scripting.

Qualifications

• 5+ years in cybersecurity operations, SOC, IR, or security engineering.

Responsibilities

• Act as frontline incident responder from detection to eradication and recovery.
• Collaborate with 3rd-party MDR for incident triage, escalation and threat hunting.
• Administer and optimize core Defense Operations tools: SIEM, EDR, cloud security, email security, and vulnerability management.
• Enhance cloud security operations across processes and tooling with internal teams.
• Drive other Motional teams to identify and mitigate cybersecurity risks.
• Provide strategic guidance to vulnerability management program and timely remediation.
• Design and operationalize security procedures, playbooks, and runbooks for MDR-related services.

Skills

5+ years experience

SOC

Incident response

Cloud security

AWS security

SIEM

EDR

Threat hunting

Vulnerability mgmt

Scripting (Python)

3rd-party collaboration

NIST/ISO frameworks

Tools

Splunk

CrowdStrike

Microsoft Defender

Job description

What You'll Be Doing:

• Act as a frontline incident responder, from detection and containment to eradication, remediation, and recovery. Facilitate post-incident reviews to drive continuous improvement in securing our people, information, and systems.
• Collaborate closely with our 3rd-party managed detection and response provider as the primary APAC region interface for incident triage, escalation, and threat hunting activities.
• Administer, monitor, and continuously optimize our core Defense Operations toolset including logging and monitoring (SIEM), endpoint detection and response (EDR), cloud security, email security, and vulnerability management services.
• Enhance cloud security operations across processes and tooling in collaboration with internal cybersecurity and engineering teams.
• Drive other Motional teams (DevOps, IT, HR, Engineering) to proactively identify, assess, and mitigate cybersecurity risks.
• Provide technical strategy and expertise to Motional's end to end vulnerability management program, helping stakeholders address significant vulnerabilities in a timely manner.
• Design, document, and operationalize security procedures, playbooks, and runbooks for key Defense Operations functions, specifically those involving Managed Detection and Response (MDR) or other third-party security service providers

What We're Looking for:

• 5+ years of full-time, hands-on experience in a cybersecurity operations, SOC, incident response, or cybersecurity engineering role.
• Strong hands-on experience with AWS and cloud-native security, including implementing security best practices across AWS infrastructure and services.
• Proven ability to analyze security alerts and logs from a wide range of cybersecurity and IT tools (SIEM, EDR, SEG, CNAPP, IAM, OS logs, application logs, etc.).
• Expertise in investigating and responding to cybersecurity incidents within frameworks such as NIST, ISO, or others.
• Background in deploying, administering, and using SIEM and/or EDR tools (e.g. Splunk, Microsoft, Crowdstrike).
• Vulnerability management skills including vulnerability scanning and CVE impact analysis.
• Ability to support security automation through basic scripting (e.g. Python, bash, Powershell)
• Excellent analytical, problem-solving, and troubleshooting skills.
• Strong written and verbal communication skills, including the ability to document technical information and present to diverse audiences.
• Ability to work independently and as part of a team in a fast-paced environment.
• Demonstrated experience in leveraging and collaborating with 3rd-party managed detection and response security partners.
• Curious and security focused mindset

Bonus Points:

• Familiarity with identity and access management tools and concepts are helpful for the role, even when not directly managing those tools (e.g. Okta, SSO, SAML).
• Terraform experience is beneficial