Senior SIEM/SOC Engineer — Automate & Detect Threats

Gratitude Philippines; Manila; On-site; PHP 1,000,000 - 1,800,000; Full time

Job summary

Gratitude Philippines in Manila is seeking experienced Security Engineers (SIEM/SOC) to design, implement, and optimize enterprise SIEM solutions. This onsite role will build automation workflows and SOAR playbooks to accelerate incident response.

You will integrate logs from cloud, network, endpoint, and application environments, develop correlation rules and dashboards, and work with SOC analysts to improve monitoring and response capabilities.

Qualifications

• 5+ years of hands-on cybersecurity experience with SIEM/SOAR engineering.
• Experience with common SIEM/SOAR platforms (Splunk, Sentinel, QRadar, Elastic, ArcSight).
• Proficiency with automation tools (Cortex XSOAR, Splunk SOAR, IBM Resilient).
• Scripting skills in Python, PowerShell, or Bash.
• Knowledge of MITRE ATT&CK, NIST, CIS frameworks.

Responsibilities

• Design, implement, and optimize enterprise SIEM solutions.
• Build automation workflows and SOAR playbooks for incident response.
• Integrate logs from cloud, network, endpoint, and apps.
• Develop correlation rules, dashboards, and detection use cases.
• Partner with SOC analysts to improve monitoring and response.
• Support compliance, investigations, and continuous security improvements.

Skills

SIEM/SOAR engineering

Splunk/Sentinel/QRadar/Elastic

XSOAR/SOAR automation

Python/PowerShell/Bash

MITRE ATT&CK/NIST/CIS

EDR/XDR and cloud security

Education

Bachelor’s degree in Cybersecurity/IT/CS

Tools

Splunk

Microsoft Sentinel

QRadar

Elastic

ArcSight

Google SecOps

Cortex XSOAR

Splunk SOAR

IBM Resilient

Job description

Gratitude Philippines in Manila is seeking experienced Security Engineers (SIEM/SOC) to design, implement, and optimize enterprise SIEM solutions. This onsite role will build automation workflows and SOAR playbooks to accelerate incident response.

You will integrate logs from cloud, network, endpoint, and application environments, develop correlation rules and dashboards, and work with SOC analysts to improve monitoring and response capabilities.