Cyber Detection Engineer

🕒 May 28

🇵🇭 Philippines – Remote

⏰ Full Time

🟡 Mid-level

🟠 Senior

👷🏻‍♀️ Engineer

👻 Ghost score 54%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

CyberOne

WebsiteLinkedInAll Job Openings

51 - 200 employees

Founded 2005

🔒 Cybersecurity

🤝 B2B

Cybersecurity • B2B

CyberOne is a UK-based cybersecurity services company that provides 24x7 managed detection and response, incident response, Microsoft security integrations, penetration testing, cloud security, and professional consulting to help organisations build measurable cyber resilience. They deliver AI-augmented MXDR and other managed security services powered by Microsoft technologies, focusing on rapid detection, containment, compliance and continuous risk reduction for enterprise and regulated sectors.

📋 Description

• Develop, tune and maintain threat-led detections across Microsoft Sentinel, Microsoft Defender XDR and the wider Microsoft Security ecosystem • Write and use KQL and Advanced Hunting for detection and investigation • Research emerging threats, vulnerabilities, attacker techniques and active campaigns, translating findings into detections, hunting queries and response guidance • Build analytics rules, hunting queries, workbooks, automation logic and alert enrichment • Work with log sources across Microsoft Defender, Azure, Microsoft 365, Entra ID, identity platforms, firewalls, SaaS tools and client environments • Recommend table schema, parsing, normalisation and ingestion optimisation improvements • Validate and optimise data connectors, log sources, telemetry coverage and Microsoft Content Hub detection capability • Map detections to attacker behaviours, TTPs and frameworks such as MITRE ATT&CK • Reduce false positives through tuning, baselining, alert performance review and SOC analyst and incident responder feedback • Develop reusable detection content, playbooks and best-practice templates for clients • Collaborate with SOC analysts and incident responders to improve triage and investigation workflows • Produce documentation for detections, use cases, data requirements, assumptions and response guidance • Support client workshops and technical discussions on detection coverage, Sentinel maturity, Defender XDR adoption, unified SecOps and monitoring strategy • Keep current with emerging threats, Microsoft security capabilities and detection engineering techniques • Incorporate information security considerations into daily activities, decisions and customer, supplier and colleague interactions • Suggest improvements and enhance how CyberOne identifies threats for clients

🎯 Requirements

• Solid understanding of cyber security fundamentals • Strong interest and understanding in using data to identify suspicious behavioural patterns • Hands-on experience with Microsoft Sentinel or another SIEM platform • Experience writing KQL queries for detection, investigation or reporting • Understanding of Microsoft Defender products, such as Defender for Endpoint, Defender for Office 365, Defender for Cloud or Defender for Identity • Familiarity with Azure, Entra ID, Microsoft 365 and common cloud security log sources • Knowledge of security monitoring concepts, alert logic, false positive tuning and detection lifecycle management • Interest in attacker behaviours, persistence techniques, lateral movement, credential abuse and common cloud attack paths • Awareness of MITRE ATT&CK, Cyber Kill Chain or similar frameworks • Ability to document technical work clearly and explain detection logic to technical and non-technical audiences • Basic scripting or automation skills, such as PowerShell, Python or Logic Apps • Collaborative mindset and willingness to work with analysts, engineers, consultants and clients • Microsoft certifications such as SC-200, AZ-500, SC-100 or SC-900 are useful but not essential • Experience with Sentinel as code, CI/CD pipelines, ARM, Bicep, Terraform or Git-based content management is useful but not essential • Experience building Sentinel workbooks, playbooks or automation rules is useful but not essential • Exposure to SOAR processes and incident response automation is useful but not essential • Experience with threat hunting or purple-team-style detection validation is useful but not essential • Familiarity with Sigma, YARA, structured detection content or detection-as-code approaches is useful but not essential • Experience working in an MSSP, consultancy or client-facing security environment is useful but not essential • Knowledge of statistics, data science, AI or machine learning applied to cyber security is useful but not essential

🏖️ Benefits

• Competitive compensation • Career growth opportunities • Access to continuous learning and certifications • Flexible working hours • Remote-first culture • Birthday off • Long-service awards • Bi-annual performance awards • Team off-sites • Structured training • Technical exposure • Career pathing • Access to cutting-edge MXDR platform and proprietary SecOps tools • Fast-track leadership opportunities