35 Threat Detection jobs in the Philippines

Responsibilities:

a) 24/7 Incident Response

• Perform triage, assess severity of incidents
• Investigate and contain security incidents
• Execute predefined response procedures

b) 24/7 Alerts Monitoring

• Continuously monitor security alerts, logs, and network traffic
• Identify potential threats or anomalies

c) Suspicious Email Analysis and other Security Validations

• Respond to reported suspicious emails
• Analyze suspicious emails, trigger email threat remediation actions
• Perform validations for reported suspicious activities and other cybersecurity concerns
• Provide recommendations on analyzed concerns

d) Documentations and other tasks

• Assist in developing and executive Recovery Plan
• Participate in investigations or forensics activities
• Participate in change management processes
• Assist in troubleshooting hardware and software issues of Collectors and MXDR agents
• Documentation of Incident Reports, weekly/monthly reporting, maintenance of
• trackers and other relevant documents
• Detection Rules review and configuration

e) Threat Intelligence duties

• Performance relevant Threat Intelligence team responsibilities such as, but not limited to:
• Indicators of compromise (IOCs): Collect, analyze, disseminate, and initiate
• blacklisting
• Compromised accounts: Monitor and validate Client's password leaks
• Brand protection initiatives: hunting of trademark infringements and other
• violations, impersonations, and sales scams. Perform validations, request for
• takedown, and monitoring

Others

• Threat Intel publications and release of advisories, and other reports
• Monitor releases of new vulnerability advisories, disseminate and track
• Monitor of other potential leaks relating to Client (e.g. code repository, database, etc.)
• Implement and enforce security policies, procedures, and best practices.
• Track and validate security controls, addressing deviations and risks.
• Should be experience in L2 incident response such as containment, isolation, root cause analysis and deep probing analysis.

Qualifications:

• Bachelor Graduate of Computer Science, IT or other related course
• Have at least 2 - 5 years - Mid level as a SOC Analyst or Security Engineer  with Threat Intelligence and Threat Detection engineering.
• Amendable to work 100% onsite in Ortigas and shifting
• Proficient in documentation, strong incident, attack response and containment skills.
• Threat hunting and use case development is a plus/ideal.

What do we have in store for you?

• A professional career adapted to your personal goals, with growth and development opportunities for all professionals
• Challenging projects with impact for leading clients in a wide range of industries
• Competitive renumeration and flexible benefits package which you may customize based on your individual needs and lifestyle
• Continuous learning and development through our Open University's virtual campus, with access to the Udemy for Business platform with more than 3,000 specialized courses
• Meaningful engagement with other employees while leading a balanced and healthy lifestyle through our clubs and various sports activities

Join Indra and have a professional career adapted to your personal goals, with continuous training in a flexible environment, and where people are the core.

Diversity is a key element of our culture. Our policies reflect our commitment to equal opportunities and recognizing the value of people and their work, and the social and natural environment wherein we operation. As such, equal opportunities, diversity, respect for people and non-discrimination (race, gender, language, religion, disability, sexual orientation, opinion, origin, economic position, birth, union membership or any other personal/social condition or circumstance) are basic principles of action for all the company's Professionals, as well as our Partners.

The Incident Response Analyst will provide detection, containment, and analysis of security events to protect the confidentiality, integrity, and availability of information systems in accordance with the firm's business objectives, regulatory requirements, and strategic goals.

Responsibilities

• Provide Tier 2 incident response services to the global organization on behalf of the Information Security Team
• Receive, process, and resolve tickets per defined SLA's
• Analyze information garnered from monitoring systems, operational incidents, and other sources to determine the scope and impact of potential security incidents, and process accordingly
• Critically assess current practices and provide feedback to management on improvement opportunities
• Assist with the design and implementation of threat detection and prevention solutions identified as necessary for the protection of Firm assets
• Effectively utilize common IR toolsets, platforms, and processes, such as SIEM, log management, packet capture, and breach detection systems
• Assist with forensic examinations and chain-of-custody procedures as directed by the Security Incident Response Engineers
• Provide input into standards and procedures
• Report compliance failures to management for immediate remediation
• Maintain assigned systems to ensure availability, reliability, and integrity, including the oversight of current and projected capacity, performance, and licensing
• Provide status reports and relevant metrics to the Security Operations Manager
• Contribute to the Firm's security-related information repositories and other marketing/awareness endeavors
• Participate in special projects as needed

Skills and Experience

Education

• Possess a Computer Science Bachelor's Degree or substantial equivalent experience

Special Requirements, Licenses, and Certifications (desirable but not required):

• GSEC, GCIH, GCFE, GREM
• CISSP or SSCP

Experience

• Some professional experience in information security with a focus on incident response and forensics
• Foundational knowledge of IR concepts and best practices, including forensics and chain-of-custody
• Experience with common IR tools such as SIEM, log management, IDS, breach detection systems (APT/BDS/EDR), and packet capture.
• Broad understanding of TCP/IP, DNS, common network services, and other foundational topics
• Working knowledge of malware detection, analysis, and evasion techniques
• Able to conduct static and dynamic analysis of malware to extract indicators of compromise, profile malware behavior, and provide recommendations for mitigating and detecting malware;  Able to analyze suspicious websites, script-based and malware code
• Experience with vulnerability management tools such as Qualys, Nessus, or other vulnerability scanning discovery tools
• Broad familiarity with the threat landscape and the ability to adapt practices to evolving circumstances
• Identify, analyze, and report threats within the enterprise by using information collected from a variety of sources (IDS/IPS, SIEM, AV), to protect data and networks.  Implement techniques to hunt for known and unknown threats based on available threat intelligence reports and knowledge of the attacker's TTPs
• Able to gather and analyze facts, draw conclusions, define problems, and suggest solutions
• Maintain critical thinking and composure under pressure
• Strong written and oral communication skills.  Ability to convey complex concepts to non-technical constituents.
• Proficiency in oral and written English
• Capable of assisting with the preparation of internal training materials and documentation
• Able to be productive and maintain focus without direct supervision
• Passionate in the practice and pursuit of IR excellence
• Can exhibit a disciplined and rigorous approach to incident handling
• Willing to accommodate shift-based work for a global organization
• Provide exemplary customer service by striving for first-call resolution and demonstrating empathy, respect, professionalism, and expertise
• Experience with digital forensics on host or network and identification of anomalous behavior on the network or endpoint devices.  Familiar with host and network-based forensic tools such as EnCase, FTK, Sleuth Kit, X Ways, etc.

We are looking for a skilled Incident Response Specialist to lead the investigation and resolution of high-priority and escalated security incidents. In this role, you will work closely with internal teams to improve the bank's cybersecurity defenses and ensure timely response to threats.

Incident Handling & Investigation

• Lead investigations of complex or escalated security incidents.
• Perform deep-dive forensic analysis, including root cause and post-incident reviews.
• Act as an escalation point for other analysts during critical security events.
• Analyze incidents to assess impact, risk, and potential data compromise.

Threat Containment & Response

• Lead threat containment, eradication, and recovery efforts.
• Identify malware behavior, compromised systems, and data infiltration attempts.
• Provide guidance to teams on remediation and recovery strategies.
• Communicate response plans clearly to asset owners and other stakeholders.

Threat Intelligence & Analysis

• Use threat intelligence to assess scope and impact of attacks.
• Analyze network traffic, malware, and suspicious behaviors to support investigations.
• Support Threat Hunting and SOC Tool teams with new detection methods.

Documentation & Playbooks

• Document incidents thoroughly from detection to resolution.
• Develop, update, and test incident response procedures and playbooks.
• Participate in simulations and response drills to ensure readiness.

Collaboration & Support

• Work with Infrastructure & Operations teams to resolve incidents.
• Collaborate with the SOC Manager and Incident Response Lead to improve processes.
• Review system metrics and monitoring data to identify trends and anomalies.

Tool Management & Continuous Improvement

• Evaluate, recommend, and troubleshoot security tools and technologies.
• Contribute to improving SOC policies, procedures, and overall maturity.
• Stay informed about new threats, vulnerabilities, and compliance requirements.

Additional Responsibilities

• Perform other tasks as assigned by the CTMD Head.

• Education: Bachelor's degree in Computer Science, Cybersecurity, or a related field.
• Experience: Proven experience in incident response, malware analysis, and threat detection.

• Technical Skills:

• Strong understanding of network, system, and application security.

• Hands-on experience with SOC tools, threat intelligence platforms, and forensic tools.

• Soft Skills:

• Clear communication with both technical and non-technical stakeholders.

• Strong analytical, problem-solving, and decision-making abilities.
• Ability to perform under pressure and manage escalated incidents.
• Knowledge: Familiarity with regulatory requirements and cybersecurity frameworks (e.g., ISO, NIST, etc.).

Job Description:

Security Alert Triage

• Continuously monitoring security alerts generated by various security tools via SecOps and messaging apps (firewalls, intrusion detection systems, etc.)
• Analyzing alerts to determine their severity, legitimacy (potential false positives), and potential organizational impact.
• Prioritizing alerts based on a predefined risk assessment framework.

Initial Investigation

• Conducting basic investigations on prioritized alerts to gather additional context and evidence.
• Utilizing security tools and threat intelligence feeds to enrich their understanding of the incident.

Incident Classification and Reporting

• Classifying incidents based on predefined categories (e.g., phishing, malware, unauthorized access attempt).
• Documenting the incident details, including timeline, potential impact, and initial investigation findings.
• Reporting the incident to relevant internal stakeholders (security team leads, IT management).

Initial Containment

• Implementing basic containment actions based on the incident type (e.g., isolating compromised systems, disabling user accounts).
• This may involve following established playbooks or procedures for specific threats.

Job Qualifications:

Education: Bachelor's degree in computer science, Computer Engineering, Information Technology, Electronic and Communications Engineering, course with specialization in Cybersecurity, and another related course

Relevant Experience: Fundamental knowledge of Cybersecurity Concepts and Frameworks

Knowledge/Training: Service Management Framework, MITRE Framework, SIEM, SOAR, Network and Endpoint Security Tools

Certification/License: CompTIA Security+, Certified Blue Team, or any other Security Operations Related Certification is an advantage

Work Condition: Able to work onsite in Makati. The role will be part of a 24/7 shifting schedule.

Hiring for Incident Response Analyst

• Full-time

• Location: Taguig City

• Set-up: Hybrid (8x RTO per month)

• Schedule: Shifting every 2 months (Day, Mid, Night)

___

JOB SUMMARY:

To provide detection, containment, and analysis of security events to protect the confidentiality, integrity, and availability of information systems per the firm's business objectives, regulatory requirements, and strategic goals.

___

JOB RESPONSIBILITIES:

• At least 4 years of relevant experience
• 1-2 years forensic analysis

Job Types: Full-time, Permanent

Pay: Up to Php120,000.00 per month

Application Question(s):

• Are you amenable to work on hybrid set-up in Taguig?

Experience:

• Incident response: 4 years (Preferred)
• Forensic analysis: 2 years (Preferred)

Work Location: In person

Responsibilities:

• Provide Tier 2 incident response services to the global organization on behalf of the Information Security Team
• Receive, process, and resolve tickets per defined SLA's
• Analyze information garnered from monitoring systems, operational incidents, and other sources to determine the scope and impact of potential security incidents, and process accordingly
• Critically assess current practices and provide feedback to management on improvement opportunities
• Assist with the design and implementation of threat detection and prevention solutions identified as necessary for the protection of Firm assets
• Effectively utilize common IR toolsets, platforms, and processes, such as SIEM, log management, packet capture, and breach detection systems
• Assist with forensic examinations and chain-of-custody procedures as directed by the Security Incident Response Engineers
• Provide input into standards and procedures
• Report compliance failures to management for immediate remediation
• Maintain assigned systems to ensure availability, reliability, and integrity, including the oversight of current and projected capacity, performance, and licensing
• Provide status reports and relevant metrics to the Security Operations Manager
• Contribute to the Firm's security-related information repositories and other marketing/awareness endeavors
• Participate in special projects as needed

Requirements:

• Possess a Computer Science Bachelor's Degree or substantial equivalent experience
• At least
  4- 5 years
  relevant experience
• L2/L3 support with full IR lifecycle experience
  (Preparation, identification, containment, eradication/remediation, recovery, lessons learned/follow-up)

What we offer:

• Direct, fulltime and permanent work engagement
• Hybrid Work Arrangement: 8 times RTO per month. Must be amenable to render overtime, work on weekends and/or PH holidays if needed.
• Shifting Schedule
• Competitive Base Pay per month
• Up to 14
  th
  month pay
• 30 days PTO
• Others, to be discussed once candidate reached the offer stage

Position: Incident Response Analyst

Work Setup: Hybrid – 8x RTO per month

Work Location: (Insert company / confidential if needed)

Schedule: Rotating shifts (changes every 2 months)

• APAC: 6:00 AM – 3:00 PM
• EMEA: 2:00 PM – 11:00 PM
• WHEM: 10:00 PM – 7:00 AM (next day)
• Sunday–Thursday or Monday–Friday
• Note:

Must be amenable to render overtime, work on weekends and Philippine holidays when neededAbout the Role

We're looking for a highly analytical Incident Response Analyst to join our global Information Security Team. This role is responsible for detecting, investigating, and mitigating security incidents to protect the organization's systems and data. You'll collaborate with security engineers, analysts, and stakeholders worldwide to maintain a secure and resilient IT environment.

Key Responsibilities

• Provide Tier 2 incident response support, analyzing alerts and investigating potential security breaches.
• Receive, process, and resolve security tickets within defined SLAs.
• Use monitoring tools and log data to determine the scope and impact of incidents.
• Support forensic analysis and evidence handling following chain-of-custody procedures.
• Operate and maintain security tools such as SIEM, IDS/IPS, EDR, and breach detection systems.
• Assist in designing and implementing new threat detection and prevention measures.
• Create incident reports and maintain documentation of security events and resolutions.
• Participate in audits, compliance reviews, and improvement of security processes.
• Provide status reports and metrics to the Security Operations Manager.
• Collaborate on security awareness initiatives and contribute to incident response playbooks.

Qualifications

Education:

• Bachelor's degree in Computer Science, Information Technology, or equivalent experience.

Experience:

• Professional experience in Information Security, particularly in Incident Response or Digital Forensics.
• Hands-on experience with SIEM, log management, vulnerability scanners (Qualys, Nessus), and endpoint detection tools.
• Solid understanding of network protocols (TCP/IP, DNS), malware analysis, and threat-hunting techniques.
• Experience analyzing network or host-based forensic data using tools like EnCase, FTK, or Sleuth Kit.
• Strong problem-solving, analytical, and documentation skills.
• Excellent written and verbal English communication skills.

Certifications (Preferred):

• GCFE, GCFA, GCTI, GREM, GPEN, GWAPT, CISSP, or SSCP

Job Type: Full-time

Pay: Php65, Php100,000.00 per month

Education:

• Bachelor's (Preferred)

Experience:

• Incident Response: 4 years (Preferred)
• Threat Detection: 4 years (Preferred)
• Malware Analysis: 4 years (Preferred)

Work Location: In person