Staff Security Engineer

Koine Ventures Inc.; Manila; On-site; PHP 1,200,000 - 1,800,000; Full time

Job summary

Koine Ventures Inc. is seeking a Staff Security Engineer in Manila to lead detection, response, and hardening across identity, endpoint, network, and email. This senior IC role shapes technical direction, tunes SOC tooling, and mentors junior analysts while supporting client and auditor compliance programs.

You will drive threat hunting, develop runbooks, and ensure robust security postures using Vanta/Drata, EDR, and policy frameworks, delivering strong client outcomes.

Qualifications

• Strong hands-on experience in security operations, detection engineering, or incident response.
• Deep identity security experience: Okta, Beyond Identity, Entra ID, Conditional Access, token and session attack patterns.
• Hands-on experience with enterprise EDR (CrowdStrike or equivalent) and endpoint investigation.
• Experience with application control and endpoint hardening (ThreatLocker, Senteon, or equivalent).
• Working knowledge of SASE/SD-WAN and network security tooling (Cato Networks, FortiGate).
• Multi-platform device management experience (NinjaOne, Addigy, Intune, Apple Business Manager).
• Experience with GRC and compliance platforms (Vanta, Drata, or equivalent).
• Incident response experience across identity, endpoint, and network.
• Vulnerability management and hardening experience.
• Working knowledge of frameworks such as NIST CSF and CIS Controls.
• Scripting and automation experience (PowerShell preferred).
• Excellent communication skills, including writing clear findings for non-technical audiences.
• A deep desire to deliver an exceptional client experience.

Responsibilities

• Build, tune, and maintain detections across the security stack to catch real threats and reduce noise.
• Own the configuration and health of SOC tooling spanning EDR, application control, endpoint hardening, identity, and network security.
• Develop and maintain detection logic, alerting rules, and automated response actions.
• Lead threat hunting across client environments to find what automated detections miss.
• Serve as the senior technical lead during security incidents and investigations.
• Lead containment, eradication, and recovery for confirmed compromises.
• Conduct root-cause analysis and produce clear post-incident findings.
• Translate incident lessons into improved detections and procedures.
• Lead the vulnerability management program: scanning, prioritization, and remediation tracking.
• Assess client environments against recognized frameworks (NIST, CIS) and identify gaps.
• Leverage GRC tooling (Vanta, Drata) to track posture, manage evidence, and support compliance programs.
• Recommend and help implement security improvements that measurably reduce risk.
• Develop and maintain SOC runbooks and investigation procedures.
• Document detections, response steps, and tooling configuration in the team's documentation systems.
• Ensure all investigations and actions are accurately tracked in Pylon.
• Build repeatable, teachable processes so the team responds consistently.
• Support compliance and evidence work using Vanta and Drata (frameworks, attestations, cyber insurance requirements).
• Contribute security data and narrative to client reporting and business reviews.
• Help translate technical security posture into business-level risk language.
• Identify and proactively communicate security risks and gaps.
• Escalate significant findings and incidents to the CISO / vCISO.
• Ensure alignment between security work and client risk priorities.
• Mentor and coach junior SOC analysts on investigation and detection skills.
• Set the technical standard for quality and rigor on the security team.
• Follow and contribute to SOPs.
• Contribute to innovation and continuous improvement initiatives.

Skills

Security operations

Detection engineering

Incident response

Identity security

EDR

Endpoint hardening

Network security

Scripting

Communication

Tools

CrowdStrike

ThreatLocker

Senteon

NinjaOne

Addigy

Intune

Apple Business Manager

Vanta

Drata

Job description

The number one goal of everyone on our team is to deliver an exceptional service and experience to our clients. The Staff Security Engineer plays a critical role in achieving that by leading the technical security work that keeps our clients protected, and proving that protection every day.

This is the most senior individual-contributor role on the security team. The Staff Security Engineer sets technical direction for detection, response, and hardening, builds and tunes the tooling our SOC relies on, and leads investigations when something serious happens.

We believe identity is the first line of defense, and this role owns much of that thesis in practice: strong detections, fast response, and continuous hardening across identity, endpoint, network, and email.

Beyond hands-on engineering, this role mentors junior SOC analysts, develops the procedures the team runs on, and supports the compliance and reporting work that demonstrates security value to clients and auditors.

RESPONSIBILITIES & TASKS

DETECTION & SECURITY ENGINEERING

• Build, tune, and maintain detections across the security stack to catch real threats and reduce noise
• Own the configuration and health of SOC tooling spanning EDR, application control, endpoint hardening, identity, and network security
• Develop and maintain detection logic, alerting rules, and automated response actions
• Lead threat hunting across client environments to find what automated detections miss

INCIDENT RESPONSE

• Serve as the senior technical lead during security incidents and investigations
• Lead containment, eradication, and recovery for confirmed compromises
• Conduct root-cause analysis and produce clear post-incident findings
• Translate incident lessons into improved detections and procedures

VULNERABILITY & POSTURE MANAGEMENT

• Lead the vulnerability management program: scanning, prioritization, and remediation tracking
• Assess client environments against recognized frameworks (NIST, CIS) and identify gaps
• Leverage GRC tooling (Vanta, Drata) to track posture, manage evidence, and support compliance programs
• Recommend and help implement security improvements that measurably reduce risk

SOC PROCEDURES & DOCUMENTATION

• Develop and maintain SOC runbooks and investigation procedures
• Document detections, response steps, and tooling configuration in the team's documentation systems
• Ensure all investigations and actions are accurately tracked in Pylon
• Build repeatable, teachable processes so the team responds consistently

COMPLIANCE & REPORTING

• Support compliance and evidence work using Vanta and Drata (frameworks, attestations, cyber insurance requirements)
• Contribute security data and narrative to client reporting and business reviews
• Help translate technical security posture into business-level risk language

COMMUNICATION, REPORTING & RISK MANAGEMENT

• Identify and proactively communicate security risks and gaps
• Escalate significant findings and incidents to the CISO / vCISO
• Ensure alignment between security work and client risk priorities

TEAMWORK & LEADERSHIP

• Mentor and coach junior SOC analysts on investigation and detection skills
• Set the technical standard for quality and rigor on the security team
• Follow and contribute to Standard Operating Procedures (SOPs)
• Contribute to innovation and continuous improvement initiatives

SKILLS AND ATTRIBUTES

REQUIRED

• Strong hands-on experience in security operations, detection engineering, or incident response
• Deep identity security experience: Okta, Beyond Identity, Entra ID, Conditional Access, token and session attack patterns
• Hands-on experience with enterprise EDR (CrowdStrike or equivalent) and endpoint investigation
• Experience with application control and endpoint hardening (ThreatLocker, Senteon, or equivalent
• Working knowledge of SASE/SD-WAN and network security tooling (Cato Networks, FortiGate)
• Multi-platform device management experience (NinjaOne, Addigy, Intune, Apple Business Manager)
• Experience with GRC and compliance platforms (Vanta, Drata, or equivalent)
• Incident response experience across identity, endpoint, and network
• Vulnerability management and hardening experience
• Working knowledge of frameworks such as NIST CSF and CIS Controls
• Scripting and automation experience (PowerShell preferred)
• Excellent communication skills, including writing clear findings for non-technical audiences
• A deep desire to deliver an exceptional client experience

NICE TO HAVE

• Experience working in a Managed Service Provider (MSP) or MSSP environment
• Certifications such as:
  • Security (Security+, CySA+, GCIH, GCIA, or equivalent)
  • Microsoft security (SC-200, SC-300, AZ-500)
  • Identity / IAM (Okta certifications or equivalent)
  • CrowdStrike certifications (CCFA, CCFR, or similar)
• Experience contributing to compliance programs or audits
• Experience with, or a strong interest in, working on LLM-based (Large Language Model) projects, including evaluating, implementing, or integrating AI-driven solutions such as automation workflows, data analysis, knowledge retrieval, and conversational systems into business or technical environments.

Researching careers? Find all the information and tips you need on career advice.