Senior Security Engineer

Rising Tide Digital Inc; Makati; On-site; PHP 1,800,000 - 3,000,000; Full time

Job summary

Rising Tide Digital Inc is seeking a senior cybersecurity professional to lead complex incident investigations across cloud, identity, endpoint, application, and network environments. You will perform root cause analysis, reconstruct kill chains, and preserve digital evidence while shaping detections and automation playbooks.

Engage in proactive threat hunting with analytics, anomaly detection, and adversary emulation, and contribute to AI-driven improvements within the AI SOC platform.

Qualifications

• Experience leading complex security investigations across cloud, identity, endpoint, application, and network environments.
• Strong ability to translate findings into detections, playbooks, and automated responses.
• Proactive threat hunting with analytics, anomaly detection, and adversary emulation techniques.

Responsibilities

• Lead complex security incident investigations across cloud, identity, endpoint, application, and network environments.
• Perform root cause analysis, reconstruct attack kill chains, preserve digital evidence.
• Translate investigation findings into new detections, automation playbooks, and AI-driven features to prevent recurrence.

Skills

Analytical mindset

On-call readiness

Cross-functional collaboration

Communication

Tools

Splunk

EDR tools

SOAR platforms

Automation frameworks

Job description

• 5+ years of experience in cybersecurity (incident response, threat detection, security
• engineering, or threat hunting).
• Strong technical expertise in cloud security, identity security, endpoint telemetry, network
• analysis, or application security.
• Proven ability to perform deep-dive incident investigations involving cloud IAM, lateral
• movement, privilege escalation, API abuse, malware, or application-layer threats.
• Hands-on experience with SIEMs (Splunk preferred), EDR tools, SOAR platforms, and
• automation frameworks.
• Ability to write and tune detection rules, correlation logic, saved searches, and behavioral
• analytics.
• Strong scripting ability (Python preferred) and familiarity with data analysis techniques.
• Willingness and ability to participate in a mandatory on-call rotation and act as a senior
• escalation point during high-severity incidents.

Preferred Qualifications

• Experience partnering with AI/ML engineering teams or contributing to AI-assisted security
• tooling.
• Background in threat intelligence, malware analysis, or offensive security (red team, adversary
• emulation).
• Knowledge of cloud-native detection patterns (AWS, Azure), identity-based attacks, and API
• security.
• Certifications such as GCIH, GCDA, GDAT, GCTI, GCFA, or equivalent are a plus.

Key Responsibilities:

Cybersecurity Incident Investigation

• Lead complex security incident investigations across cloud, identity, endpoint, application, and network environments.
• Perform root cause analysis, reconstruct attack kill chains, and preserve digital evidence.
• Translate investigation findings into new detections, automation playbooks, and AI-driven features to prevent recurrence and address detection gaps.
• Participate in a mandatory on-call rotation as a senior escalation point for complex security incidents, ensuring timely investigations and incorporating lessons learned into detections, automations, and the AI SOC platform.

Threat Detection Engineering

• Design, develop, and optimize high-fidelity detection logic across Splunk, SOAR, cloud platforms, and other security telemetry systems.
• Establish repeatable processes for hypothesis-driven detection development, simulation, validation, and tuning.
• Improve detection accuracy by reducing false positives and strengthening behavioral and contextual analytics.

Proactive Threat Hunting

• Conduct proactive, intelligence-driven threat hunts across large datasets using advanced analytics, anomaly detection, and adversary emulation techniques.
• Identify unknown threats, emerging attacker behaviors, and gaps in telemetry and security tools.
• Convert threat-hunting insights into reliable detections, AI models, automated enrichment processes, and improved investigation workflows.
• Enhance the AI SOC platform's ability to conduct autonomous or semi-autonomous investigations by developing high-value signals, features, and decision logic.
• Collaborate with AI and Security Engineering leaders to integrate threat-hunting patterns, investigation techniques, and detection insights into AI pipelines.
• Develop feedback loops that enable AI models to learn from analyst investigations and continuously improve performance.

Automation and SOAR Engineering

• Develop reliable automation workflows for security alert triage, data enrichment, event correlation, and containment actions.
• Collaborate with Detection Engineering and Splunk/SOAR teams to integrate new data sources, threat intelligence feeds, and enrichment pipelines.

Collaboration and Engineering Excellence

• Collaborate with SecOps, Cloud, AppSec, Detection Engineering, and AI Engineering teams to improve detection coverage and operational efficiency.
• Develop and maintain technical documentation, playbooks, knowledge articles, and engineering runbooks.
• Mentor SOC analysts, junior engineers, and cross-functional teams to improve investigation quality and strengthen detection engineering maturity.