Service Operations Support Engineer

Trends Group Inc.; Makati; On-site; PHP 800,000 - 1,100,000; Full time

Job summary

Trends Group Inc. in Makati, Philippines, seeks a Service Operations Support Engineer to provide Tier 2/3 technical support across MSOC and MNOC, focusing on detection engineering, platform administration, automation, and continuous improvement.

You will work with SIEM, EDR/NDR, TIP, NMS, ITSM, and SOAR to optimize detection, automate tasks, and strengthen security monitoring and response capabilities. Strong collaboration with cross-functional teams and adherence to security frameworks are

Qualifications

• Bachelor’s degree in Computer Science, Cybersecurity, Network Engineering, or related field, or equivalent practical experience.
• Demonstrated MSOC/MNOC operations experience with security and network operations.
• Hands-on experience with SIEM, EDR/NDR, TIP, and SOAR platforms, plus ITSM integration.

Responsibilities

• Provide Tier 2/3 technical support and manage escalations across security and network operations.
• Maintain reliability and availability of security platforms, log pipelines, and monitoring systems.
• Design, test, deploy, and optimize SIEM correlation rules and detection logic to reduce false positives and identify threats.
• Develop, maintain, and optimize automated playbooks within SOAR platforms and create scripts using Python, PowerShell, Bash, and REST APIs.
• Manage EDR/NDR and TIP platforms, refine policies, and integrate threat intelligence with SIEM/EDR/NDR/SOAR.
• Administer ITSM platforms (e.g., ServiceNow, Jira Service Management) and streamline ticket workflows to improve incident management and SLA adherence.
• Administer NMS (Site24x7, LibreNMS, SolarWinds) and endpoint management (ManageEngine Endpoint Central, Microsoft Intune) to optimize monitoring and asset management.

Skills

SIEM

EDR/NDR

SOAR

NMS

ITSM

Automation

Education

Bachelor's degree in CS/Cybersecurity/Network Eng or related

Tools

Splunk

Rapid7

Microsoft Sentinel

Elastic

IBM QRadar

Site24x7

LibreNMS

SolarWinds

ManageEngine Endpoint Central

Microsoft Intune

Job description

I. PURPOSE

The Service Operations Support Engineer will provide advanced Tier 2/3 technical support across Managed Security Operations Center (MSOC) and Managed Network Operations Center (MNOC) environments. The role focuses on detection engineering, platform administration, automation, and continuous improvement to enhance operational efficiency, strengthen security detection and response capabilities, and ensure reliable service delivery.

The position requires strong technical expertise in SIEM, EDR/NDR, Threat Intelligence Platforms (TIP), Network Management Systems (NMS), endpoint management, IT Service Management (ITSM), and Security Orchestration, Automation, and Response (SOAR) solutions, with an emphasis on optimizing tools, processes, and workflows.

Ii. Duties And Responsibilities

MSOC and MNOC Operations Support

• Provide Tier 2/3 technical support and manage escalations across security and network operations.
• Maintain the reliability, scalability, and availability of security platforms, log pipelines, and network monitoring systems.
• Investigate and resolve complex security alerts, network availability issues, telemetry interruptions, and system health concerns.

Detection Engineering and SIEM Management

• Administer, maintain, and optimize enterprise SIEM platforms.
• Design, develop, test, deploy, and fine-tune SIEM correlation rules and detection logic to reduce false positives and identify emerging threats.
• Align detection capabilities with industry frameworks, including MITRE ATT&CK.
• Conduct regular detection rule reviews and performance assessments to improve accuracy and effectiveness.

Automation, Scripting, and SOAR

• Develop, maintain, and optimize automated playbooks within SOAR platforms.
• Create scripts using Python, PowerShell, Bash, and REST APIs to integrate security and network tools, process complex logs, and automate repetitive operational tasks.
• Identify workflow inefficiencies across MSOC and MNOC operations and implement automation solutions to improve alert handling, response times, and overall productivity.

EDR/NDR and Threat Intelligence Platform Optimization

• Administer, configure, and optimize Endpoint Detection and Response (EDR) and Network Detection and Response (NDR) solutions.
• Refine security policies, exclusion lists, and detection queries to maintain effective security visibility while minimizing performance impacts.
• Manage and optimize Threat Intelligence Platforms (TIP), including the automated ingestion and enrichment of threat intelligence feeds, Indicators of Compromise (IOCs), and Indicators of Attack (IOAs).
• Integrate threat intelligence with SIEM, EDR, NDR, and SOAR platforms to improve threat detection and incident response.

ITSM Administration and Process Improvement

• Administer and configure ITSM platforms, such as ServiceNow, Jira Service Management, and ManageEngine ServiceDesk Plus, to support incident management, service requests, change management, and SLA tracking.
• Integrate ITSM workflows with SOAR, SIEM, NMS, and alerting platforms to streamline ticket management and automate escalation processes.
• Analyze operational metrics and service performance data to improve ticket routing, response efficiency, and service delivery workflows.

Network and Endpoint Management Systems

• Administer, configure, and optimize NMS platforms, such as Site24x7, LibreNMS, and SolarWinds, for network monitoring, fault and performance management, and topology mapping.
• Manage and optimize endpoint management platforms, including ManageEngine Endpoint Central and Microsoft Intune.
• Fine-tune alert thresholds, polling intervals, and notification policies to reduce unnecessary alerts while maintaining visibility into critical security and availability events.

Iii. Qualifications

Minimum Educational Requirements

• Bachelor's degree in Computer Science, Cybersecurity, Network Engineering, or a related field, or equivalent practical experience.

Minimum Experience and Technical Requirements

MSOC/MNOC Operations

• Demonstrated experience supporting security and network operations, with a solid understanding of network protocols, log management, and incident management lifecycles.

NMS And Endpoint Management

• Hands-on experience administering, configuring, and optimizing NMS solutions, such as Site24x7, LibreNMS, and SolarWinds, as well as endpoint management platforms, including ManageEngine Endpoint Central and Microsoft Intune.

Detection Engineering And SIEM

• Proven experience developing, testing, and tuning SIEM correlation rules and detection logic using platforms such as Splunk, Rapid7, Microsoft Sentinel, Elastic, and IBM QRadar.

EDR/NDR And Threat Intelligence

• Practical experience managing EDR/NDR solutions, such as CrowdStrike, Microsoft Defender for Endpoint, and ExtraHop, as well as TIP platforms, including MISP, ThreatConnect, Anomali, and Cyble.

SOAR, Scripting, And ITSM

• Hands-on experience developing SOAR playbooks, creating automation scripts using Python, PowerShell, Bash, and REST APIs, and administering ITSM platforms such as ServiceNow, Jira Service Management, and ManageEngine ServiceDesk Plus.

Competencies

• Demonstrates initiative in identifying operational inefficiencies and implementing improvements through tool optimization, process enhancement, and automation.
• Capable of working effectively in a fast-paced environment supporting 24/7 security and network operations.
• Possesses strong technical documentation, analytical, troubleshooting, and cross-functional communication skills.
• Demonstrates a continuous improvement mindset and the ability to collaborate with multiple teams to enhance operational performance.

Preferred Certifications

Security and Operations

• CompTIA Cybersecurity Analyst (CySA+)
• GIAC certifications, including GCDA, GCIH, GMON, and GCTI
• Splunk Core Certified Advanced Power User or Developer
• CrowdStrike Certified Administrator
• Google SecOps Administrator
• Google Security Operations SOAR Developer
• Swimlane Certified SOAR Administrator
• EC-Council Certified Threat Intelligence Analyst

Network and Systems

• Cisco CCNA or CCNP
• CompTIA Network+
• ITIL Foundation
• Microsoft certifications related to enterprise administration, Intune, or endpoint management

IV. WORKING CONDITIONS

May be required to work beyond regular business hours, including weekends and holidays, to support project deadlines, maintain operational continuity, and address urgent client incidents or service requirements.