Client Security Lead

Job not on LinkedIn

🔥 12 hours ago

🇵🇭 Philippines – Remote

⏰ Full Time

🟠 Senior

👮‍♂️ Cybersecurity / Security Engineer

👻 Ghost score 15%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

THEOS Cyber

WebsiteLinkedInAll Job Openings

11 - 50 employees

Founded 2019

💼 Consulting

🏥 Healthcare

📦 Logistics

Consulting • Healthcare • Logistics

THEOS Cyber is a cybersecurity services firm that provides managed threat detection and response, red teaming, penetration testing, cyber engineering, and digital forensics/incident response to help organizations detect, contain, and remediate cyber threats. The company works with enterprise clients across sectors such as casinos, crypto, financial services, fintech, gaming, manufacturing, NGOs, technology, and utilities, and partners with vendors like Microsoft, CrowdStrike, and Claroty. THEOS emphasizes a customer-focused, outcomes-driven approach with 24/7 monitoring, human-led analysis, threat hunting, and tailored engineering and consulting services.

📋 Description

• Serve as the named technical security owner for a defined set of client accounts • Own the effectiveness and continuous improvement of the MTDR service for assigned clients • Act as the two-way technical interface between clients and Theos Defence’s SOC • Maintain deep knowledge of client architecture, asset inventory, and strategic roadmap • Lead monthly reviews covering events of interest and security posture enhancements • Bring client context to SOC analysts and engineers and handle escalations • Conduct hypothesis-driven threat hunts based on CTI, detection gaps, and ATT&CK-mapped attack paths • Translate threat intelligence, indicators, and TTPs into actionable detection logic • Audit, tune, prune, and improve detection rules to reduce alert noise • Identify misconfigurations, AD risks, and broken baseline controls and help clients remediate them • Investigate major incidents by correlating endpoint, identity, cloud, and network telemetry • Construct incident timelines, blast-radius assessments, and root-cause analyses • Support active compromise assessments and incident response engagements with environment context, hunting queries, and detection logic • Perform investigation quality checks and mentor junior analysts • Use analyst pain points to drive detection-engineering improvements

🎯 Requirements

• Experience building, tuning, and retiring detection rules in major SIEM/XDR platforms • Direct experience with Microsoft Sentinel or CrowdStrike Falcon is a plus • Strong query fluency on another SIEM/XDR platform acceptable • Ability to write non-trivial detection logic independently • Ability to evaluate detection-rule trade-offs between alert fatigue and missed edge cases • Experience in threat hunting or incident response • Experience owning hunts and incidents from initial signal through root cause • Ability to structure hunts around testable hypotheses and identify disconfirming evidence • Ability to correlate endpoint, identity, cloud, and network logs to reconstruct timelines and blast radius • Working knowledge of at least one major cloud/identity ecosystem: Microsoft Azure, Entra ID, M335, or AWS • Ability to trace cloud audit and sign-in logs and map activity to endpoint activity • Understanding of real-world cloud/identity attacks, including password spraying, consent phishing, and excessive permission abuse • Ability to communicate with senior leadership, technical teams, and non-technical decision-makers • Ability to write crisp, professional client-facing documentation • Ability to quickly map unfamiliar technical environments and maintain an updated mental model • Multi-account MSSP/consulting experience is a plus, not required • Formal incident response or compromise assessment background is a plus, not required • Python or PowerShell skills are a plus, not required • Practical understanding of AI/AI Agent security risks and novel attack vectors is a plus, not required • Familiarity with Asia-Pacific threat actors, TTPs, and sector risks is a plus, not required

🏖️ Benefits

• Continuous Development of People • Remote work arrangement • Premium Security Services environment • Full-time employment