Security Operations Analyst

The Job

We're looking for a Security Operations Analyst. Someone who improves the systems they operate. Your role as the Security Operations Analyst is to turn security telemetry into actionable information and continuously improve how Sonatus detects, investigates, and responds to threats. You’ll be responsible for reviewing alerts, findings, and scan results, determining what matters, taking appropriate action, and helping make future investigations more efficient through better detections, reduced noise, and stronger playbooks.

You will report to the IT & Security Manager and work closely with a Senior Security Remediation Engineer who builds the automation behind the team’s workflows and will mentor you on scripting.

The Role

• Develop and tune Wazuh detection rules, write SIEM searches and threat-hunting queries, and contribute detection-as-code through pull requests. Recommend new detections based on incidents and observed behavior.
• Monitor and triage alerts from Wazuh, Cisco XDR, GitHub, cloud security tools, and our managed SOC partner. Validate GitHub secret-scanning alerts, coordinate with repository owners on secret rotation, and triage findings from our AI agent governance platform.
• Operate our agentic AI governance platform to monitor AI agents across the environment. Triage findings, route issues to the appropriate owners, and help develop policies and detections for this emerging area of security.
• Investigate suspicious activity across endpoints, identity, SaaS, GitHub, Google Workspace, and cloud environments. Perform IOC searches, enrich investigations with threat intelligence, and investigate reported phishing.
• Triage Tenable findings and help establish priorities for remediation. Identify duplicates, exceptions, and false positives while tracking vulnerability aging and trends.
• Reduce false positives and improve signal quality. Build investigation and triage playbooks, and design the Jira templates, queues, and workflows used by the team.
• Create dashboards and operational security metrics that demonstrate program performance.
• Develop Python, API, and low-code automations for alert enrichment. Collaborate with engineering to turn larger automation ideas into production solutions.
• Support access reviews, the security risk register, and technical evidence requirements for ISO 27001 and TISAX audits.

Qualifications

• 2 – 4 years of experience in security operations, a SOC, or IT operations with hands-on security responsibilities.
• Hands-on experience with at least one platform such as Wazuh, Splunk, Elastic, Sentinel, or Cisco XDR, including writing or tuning detection rules—not just monitoring alerts.
• Experience turning vulnerability scanner results into prioritized remediation work and following through to resolution.
• Comfortable reviewing logs, identifying common attack patterns, and investigating phishing and suspicious activity.
• Some experience with Python or a similar scripting language, or a strong willingness to develop these skills quickly.
• Clear written English, with the ability to document findings that engineers can act on and create playbooks others can follow.
• You naturally identify opportunities to improve processes, take action to make them better, and ensure nothing falls through the cracks.

What We Offer

• Hybrid Setup (onsite work required)
• Free lunch every WFO
• Competitive Salary
• Fixed weekends off
• US Based Company

Location: IT Park, Cebu

Shift: Day Shift 6:00 AM - 3:00 PM

Pay: From Php59,000.00 per month

Benefits:

• Health insurance
• Staff meals provided

Experience:

• SIEM: 2 years (Preferred)
• Vulnerability management: 2 years (Preferred)
• Scripting: 2 years (Preferred)
• Python: 1 year (Preferred)

Location:

• Cebu City, Cebu (Preferred)

Work Location: Hybrid remote in Cebu City