Service Operations Support Engineer

Trends Group, Inc.; Makati; On-site; PHP 700,000 - 1,300,000; Full time

Job summary

Trends Group, Inc. is seeking a Service Operations Support Engineer to provide advanced Tier 2/3 support across MSOC and MNOC environments.

The role emphasizes detection engineering, platform administration, automation, and continuous improvement to boost efficiency, security perception, and reliable service delivery. The candidate will configure SIEM/EDR/NDR, manage TIP ingestion, develop automation scripts, and integrate security tooling with ITSM platforms.

Qualifications

• Bachelor’s degree in CS, cybersecurity, or related field or practical experience.
• Hands-on experience supporting MSOC/MNOC operations.
• Experience with NMS and endpoint management tools such as Site24x7, LibreNMS, SolarWinds, ManageEngine Endpoint Central, and Microsoft Intune.
• Proven SIEM experience with Splunk, Rapid7, Microsoft Sentinel, Elastic, or IBM QRadar.
• Practical EDR/NDR experience with CrowdStrike, Defender for Endpoint, and ExtraHop; familiarity with TIP platforms (MISP, ThreatConnect, Anomali, Cyble).
• Experience building SOAR playbooks; scripting in Python/PowerShell/Bash; ITSM tooling (ServiceNow, Jira Service Management, ManageEngine ServiceDesk Plus).

Responsibilities

• Provide Tier 2/3 support and manage escalations across security and network operations.
• Maintain reliability and availability of security platforms and monitoring systems.
• Investigate and resolve complex security alerts and telemetry issues.
• Administer and optimize SIEM platforms and develop detection rules to reduce false positives.
• Develop automation scripts and SOAR playbooks to streamline operations.
• Manage EDR/NDR configurations and optimize TIP ingestion and enrichment.
• Integrate threat intelligence with SIEM, EDR, NDR, and SOAR platforms.
• Administer ITSM platforms and integrate workflows with security tooling.
• Optimize NMS and endpoint management systems and fine-tune alerting policies.

Skills

MSOC/MNOC Operations

NMS Administration

Endpoint Management

SIEM / Detection Engineering

EDR/NDR

Threat Intelligence Platforms

SOAR & Automation

ITSM Administration

Python / PowerShell / Bash

REST APIs

Education

Bachelor’s degree in CS/Cybersecurity/Networking

Tools

Site24x7

LibreNMS

SolarWinds

ManageEngine Endpoint Central

Microsoft Intune

ServiceNow

Jira Service Management

ManageEngine ServiceDesk Plus

Splunk

Rapid7

Microsoft Sentinel

Elastic

IBM QRadar

MISP ThreatConnect Anomali Cyble

Job description

I. PURPOSE

The Service Operations Support Engineer will provide advanced Tier 2/3 technical support across Managed Security Operations Center (MSOC) and Managed Network Operations Center (MNOC) environments. The role focuses on detection engineering, platform administration, automation, and continuous improvement to enhance operational efficiency, strengthen security detection and response capabilities, and ensure reliable service delivery.

The position requires strong technical expertise in SIEM, EDR/NDR, Threat Intelligence Platforms (TIP), Network Management Systems (NMS), endpoint management, IT Service Management (ITSM), and Security Orchestration, Automation, and Response (SOAR) solutions, with an emphasis on optimizing tools, processes, and workflows.

II. DUTIES AND RESPONSIBILITIES

1. MSOC and MNOC Operations Support

• Provide Tier 2/3 technical support and manage escalations across security and network operations.

• Maintain the reliability, scalability, and availability of security platforms, log pipelines, and network monitoring systems.

• Investigate and resolve complex security alerts, network availability issues, telemetry interruptions, and system health concerns.

2. Detection Engineering and SIEM Management

• Administer, maintain, and optimize enterprise SIEM platforms.

• Design, develop, test, deploy, and fine-tune SIEM correlation rules and detection logic to reduce false positives and identify emerging threats.

• Align detection capabilities with industry frameworks, including MITRE ATT&CK.

• Conduct regular detection rule reviews and performance assessments to improve accuracy and effectiveness.

3. Automation, Scripting, and SOAR

• Develop, maintain, and optimize automated playbooks within SOAR platforms.

• Create scripts using Python, PowerShell, Bash, and REST APIs to integrate security and network tools, process complex logs, and automate repetitive operational tasks.

• Identify workflow inefficiencies across MSOC and MNOC operations and implement automation solutions to improve alert handling, response times, and overall productivity.

4. EDR/NDR and Threat Intelligence Platform Optimization

• Administer, configure, and optimize Endpoint Detection and Response (EDR) and Network Detection and Response (NDR) solutions.

• Refine security policies, exclusion lists, and detection queries to maintain effective security visibility while minimizing performance impacts.

• Manage and optimize Threat Intelligence Platforms (TIP), including the automated ingestion and enrichment of threat intelligence feeds, Indicators of Compromise (IOCs), and Indicators of Attack (IOAs).

• Integrate threat intelligence with SIEM, EDR, NDR, and SOAR platforms to improve threat detection and incident response.

5. ITSM Administration and Process Improvement

• Administer and configure ITSM platforms, such as ServiceNow, Jira Service Management, and ManageEngine ServiceDesk Plus, to support incident management, service requests, change management, and SLA tracking.

• Integrate ITSM workflows with SOAR, SIEM, NMS, and alerting platforms to streamline ticket management and automate escalation processes.

• Analyze operational metrics and service performance data to improve ticket routing, response efficiency, and service delivery workflows.

6. Network and Endpoint Management Systems

• Administer, configure, and optimize NMS platforms, such as Site24x7, LibreNMS, and SolarWinds, for network monitoring, fault and performance management, and topology mapping.

• Manage and optimize endpoint management platforms, including ManageEngine Endpoint Central and Microsoft Intune.

• Fine-tune alert thresholds, polling intervals, and notification policies to reduce unnecessary alerts while maintaining visibility into critical security and availability events.

III. QUALIFICATIONS

A. Minimum Educational Requirements

• Bachelor's degree in Computer Science, Cybersecurity, Network Engineering, or a related field, or equivalent practical experience.

B. Minimum Experience and Technical Requirements

• MSOC/MNOC Operations: Demonstrated experience supporting security and network operations, with a solid understanding of network protocols, log management, and incident management lifecycles.

• NMS and Endpoint Management: Hands-on experience administering, configuring, and optimizing NMS solutions, such as Site24x7, LibreNMS, and SolarWinds, as well as endpoint management platforms, including ManageEngine Endpoint Central and Microsoft Intune.

• Detection Engineering and SIEM: Proven experience developing, testing, and tuning SIEM correlation rules and detection logic using platforms such as Splunk, Rapid7, Microsoft Sentinel, Elastic, and IBM QRadar.

• EDR/NDR and Threat Intelligence: Practical experience managing EDR/NDR solutions, such as CrowdStrike, Microsoft Defender for Endpoint, and ExtraHop, as well as TIP platforms, including MISP, ThreatConnect, Anomali, and Cyble.

• SOAR, Scripting, and ITSM: Hands-on experience developing SOAR playbooks, creating automation scripts using Python, PowerShell, Bash, and REST APIs, and administering ITSM platforms such as ServiceNow, Jira Service Management, and ManageEngine ServiceDesk Plus.

C. Competencies

• Demonstrates initiative in identifying operational inefficiencies and implementing improvements through tool optimization, process enhancement, and automation.

• Capable of working effectively in a fast-paced environment supporting 24/7 security and network operations.

• Possesses strong technical documentation, analytical, troubleshooting, and cross-functional communication skills.

• Demonstrates a continuous improvement mindset and the ability to collaborate with multiple teams to enhance operational performance.

D. Preferred Certifications

Security and Operations

• CompTIA Cybersecurity Analyst (CySA+)

• GIAC certifications, including GCDA, GCIH, GMON, and GCTI

• Splunk Core Certified Advanced Power User or Developer

• CrowdStrike Certified Administrator

• Google SecOps Administrator

• Google Security Operations SOAR Developer

• Swimlane Certified SOAR Administrator

• EC-Council Certified Threat Intelligence Analyst

Network and Systems

• Cisco CCNA or CCNP

• CompTIA Network+

• ITIL Foundation

• Microsoft certifications related to enterprise administration, Intune, or endpoint management

IV. WORKING CONDITIONS

• May be required to work beyond regular business hours, including weekends and holidays, to support project deadlines, maintain operational continuity, and address urgent client incidents or service requirements.