Threat Detection Engineer — Remote, MS Sentinel Focus

CyberOne; Philippines; Remote; PHP 900,000 - 1,300,000; Full time

Benefits offered by this job

Flexible working hours

Remote-first culture

Birthday off

Job summary

CyberOne specializes in Microsoft security, seeking a Detection Engineer to strengthen threat detection across Microsoft Sentinel and Defender XDR. You will craft detections, hunting queries and automation, while collaborating with analysts, consultants and clients to deliver proactive security monitoring.

A curious mindset and data-driven approach are essential. This full-time role offers flexible, remote-first work with opportunities to work across cloud, hybrid and enterprise environments,

Qualifications

• Hands-on experience with Microsoft Sentinel or another SIEM platform.
• Experience writing KQL queries for detection, investigation or reporting.
• Understanding of Microsoft Defender products and cloud security log sources.
• Familiarity with Azure, Entra ID, Microsoft 365 security technologies.

Responsibilities

• Develop, tune and maintain threat-led detections across Microsoft Sentinel and Defender XDR.
• Translate threat intel and attacker techniques into practical detections and hunting queries.
• Build analytics rules, hunting queries, workbooks and automation to improve detection and response.
• Collaborate with SecOps engineers to optimise data connectors and telemetry coverage.
• Document detection logic and provide guidance for response and incident handling.

Skills

Microsoft Sentinel

KQL

Threat detection

Security analytics

Incident response

PowerShell

Python

Logic Apps

Tools

Azure

Defender XDR

Job description

CyberOne specializes in Microsoft security, seeking a Detection Engineer to strengthen threat detection across Microsoft Sentinel and Defender XDR. You will craft detections, hunting queries and automation, while collaborating with analysts, consultants and clients to deliver proactive security monitoring.

A curious mindset and data-driven approach are essential. This full-time role offers flexible, remote-first work with opportunities to work across cloud, hybrid and enterprise environments,