Threat Intelligence Team Lead
4 days ago
I PURPOSE
Participate and support activities that will help improve the existing operations and operationalize new service portfolio to achieve service excellence, operational efficiency, and retention of customers.
II. DUTIES AND RESPONSIBILITIES
- Accomplish all assigned tasks by the management in a timely and effective manner as deemed necessary for the betterment of the organization.
- Ensure effective and efficient processes are followed, and that proper escalation protocols are in place and complied with by the team.
- Report significant events to immediate superior and ensure smooth and effective shift turnovers.
- Contribute to the knowledge and information relevant to Operations.
- Participate in activities promoting a harmonious working environment such as demonstrating trust and respect and practicing open communication.
- Comply with company policies, guidelines, standards, and procedures.
- Professionally represent Trends management; enriching client relationships and providing expertise, composure, and competence.
- Perform all other duties and tasks as assigned by the Threat Intelligence Manager and MSS Manager.
Threat Intelligence
- Monitor the displayed information on the Threat Intelligence Platform (TIP) related to emerging threats, vulnerabilities, campaigns, etc.
- Conduct research using the Threat Intelligence Platform (TIP) or any other relevant source of information such as open-source, proprietary or commercial information to gather cyber and IT information about threats, vulnerabilities, and/or any other party that needs to be monitored for awareness.
- Monitor, utilize the collected data, and report to the client if affected by pre-NVD and zero-day vulnerabilities.
- Utilize Threat Intelligence Platform's threat intelligence card and advanced queries for deeper and more contextual investigation.
- Investigate information on the intention to target clients, their industry like major activist campaigns, and indications of activism and all relevant intelligence against the clients.
- Perform industry peer comparison and determine the trending attack methods.
- Prepare and submit the following reports based on frequency:
- Operational Intelligence Report (Weekly Digest)
- Tactical Intelligence Report (Daily Digest)
- Incident-related Reports (Adhoc)
- Other operational report as directed by the business
- Lead the team in establishing cyber protection programs and activities.
- Perform as lead researcher, giving guidance to team on where, what, and how to dig information.
- Review materials prepared and written by the team.
- Create analyst notes (or validated research documents) and collaborate with other members of the team for verification of reports.
- Detect, report, and request for takedowns of servers launching phishing attacks, fake applications that impersonate legitimate ones from app stores, malicious websites, or fraudulent social media accounts.
- Report any brand attack and data leakage detection from the solution with corresponding mitigating actions.
Threat Hunting
- Configure tools and detect patterns/outliers within client environments matching tactics, techniques, or procedures (TTPs) of known threat actors, malware or other unusual or suspicious behaviors.
- Conduct cyber hunts in support of identifying emerging threats on behalf of multiple clients, often operating as a lead investigator.
- Provide expert analytic investigative support for large-scale and complex security incidents across multiple clients and support the TOC team through the investigation, recommendations, response, and post-mortem efforts.
- Monitor multiple client environments and investigate & report on emerging threats.
- Work with internal teams on orchestration & tool-based enablement and optimization of team processes supporting overall service delivery.
- Conduct dynamic and static malware analysis on samples obtained during incident handling or hunt operations to identify IOCs.
- Contribute to documenting simple and reusable hunt tactics and techniques for the extended and shifting team delivering threat services.
- Engage with client POCs as necessary to help them truly mature and optimize their security architecture, primarily from a risk management and incident response perspective.
Availability Management
- Operationalization of management defined metrics and reporting compliance.
- Ensures that tools being used are appropriate for the agreed service level targets for availability such as tools for role-based access design, availability reporting, and design testing.
- Escalate availability and capacity-related issues and provide suggestions.
Capacity Management
- Execute strategies developed by the managers to deliver the service and plans for short, medium, and long-term business requirements.
- Ensure that resources of managed devices are within the acceptable thresholds.
- Escalate threshold breaches.
IT Service Continuity Management
- Perform the role assigned in the Business Continuity Plan (BCP).
- Lead the team in following and participating in Business Continuity Plan (BCP) activities to ensure continuity of performance of people and processes and that minimum agreed service levels are met in case of a disruptive incident/s.
Risk Management
- Participate in the execution of risk treatment plans to people and processes needed for Service Operations that may impact clients, Sales Groups, and other relevant stakeholders.
Service Level Management
- Ensure compliance of Service Level Agreements with clients.
- Manage the performance of team members in Internal Support
- Monitor and report on Operational Service Levels.
Configuration Management
- Collects and ensures accurate information of configurations of client assets during Service Operations.
- Maintains information about Configuration Items (CIs) of client assets as part of Service Operations.
- Maintains a logical model, containing the components of client CIs and their associations.
- Handover configuration items and other relevant information to Service Transition for Offboarding.
Client Support
- Ensure that the team members are:
o Performing triage on received events and incidents.
o Handling cases assigned.
o Undertaking immediate effort/s to restore a failed service of a Managed Service client as quickly as possible.
o Performing brand monitoring and takedown requests.
o Handling escalation and follow-ups until resolution.
- Create Incident and Root-Cause-Analysis (RCA) Reports.
- Execute set frameworks, guidelines, and procedures that follow best practices and applicable frameworks for Events Management, Incident Management, and Service Requests.
Client Incident Management
- Create operational playbooks to detect, analyze, eradicate, remediate, and recover from client cybersecurity and quality of service incidents.
- Lead resolution of P2 and P3 escalations.
- Lead initial triage and resolution of P1 incidents.
- Escalate incidents that may turn into a problem or disaster.
- Create RCA Reports and execute Compromise Assessment/Preventive Action (CA/PA).
Client Access Management
- Ensure team members perform authorization of users' right to access client assets, while preventing access to non-authorized users.
- Essentially executes Terms and Conditions of the client.
Client IT Asset Management
- Ensure that clients' managed assets are accounted for, maintained, upgraded if within scope.
- Monitors the clients' managed assets lifecycle and provides reports and recommendations to the Client, Service Delivery Manager/s, and other relevant stakeholders.
Client Problem Management
- Provide necessary data and ensure CA/PA is implemented.
- Ensure team's compliance to contractual problem management deliverables.
Process Management
- Create, share, use, and manage the documented processes of Service Operations, and ensure that these processes are being followed.
Knowledge Management
- Responsible in updating the knowledge and information pertaining to existing Clients and clients' Managed ICT assets.
Continual Service Improvement Management
- Execute improvement plans of the people and processes of Service Operations.
- Suggest, follow, and deploy new processes, and ensure that the team follows.
- Review and guarantee quality of data and content of tickets.
III. QUALIFICATIONS
A. Minimum Education
- Must be a graduate of any IT related bachelor's degree such as:
o Computer Studies
o Computer Engineering
o Information Technology
o Electronics Engineering
B. Minimum Experience/Training
- Have at least 3-4 years of working experience in a 24x7x365 Security Operations Center.
- Trainings and/or certifications on any of the following domains are required:
o IT Service Management
o IT Infrastructure (Network, Servers, Cloud, etc.)
o Cybersecurity and/or Information Security
- Threat Intelligence Certifications i.e. CTIA, GCTI, CCTIA
- eCTHPv2 or other related certification
- OSINT/Threat Intelligence Trainings
IV WORKING CONDITIONS
Reporting to the company's main office in Makati City.
Shifting schedule.
Collaborate physically and/or virtually with internal and external stakeholders.
May travel for company-sponsored conferences and related marketing events.
Attend training and acquire certifications that are applicable to the role.
-
Threat Intelligence Manager
2 weeks ago
Makati City, National Capital Region, Philippines Trends Group, Inc. Full time ₱1,200,000 - ₱3,600,000 per yearI. PURPOSEExecute activities that will improve existing operations and operationalize new service portfolio to achieve service excellence, operational efficiency, business profitability, and retention of customers.II. DUTIES AND RESPONSIBILITIESAccomplish all assigned tasks by the management in a timely and effective manner as deemed necessary for the...
-
Insider Threat Analyst
4 days ago
Makati City, National Capital Region, Philippines Strategic Staffing Solutions Full time ₱800,000 - ₱1,200,000 per yearStrategic Staffing Solutions (S3) | Cyber Insider Threat AnalystLocation:Ayala, Makati CityWork Setup:Hybrid (2 Days Onsite / 3 Days Remote)Schedule:Day ShiftWe are seeking aCyber Insider Threat Analystto join our cybersecurity team atStrategic Staffing Solutions (S3). This role is focused ondetecting, investigating, and mitigating insider threatsto...
-
Information Security Analyst
3 weeks ago
Makati City, National Capital Region, Philippines Smart Communications, Inc. Full timeOverviewLocation: Cyber Security Operations CenterReports To: Cyber Security Incident Investigation and Threat Intel ManagerDivision: Cyber Security Investigation and Threat IntelAre you passionate about uncovering the root cause of security incidents and leading investigations that make a real impact? Join our Cyber Security Operations Group as an Incident...
-
Information Security Analyst
4 days ago
Makati City, National Capital Region, Philippines Smart Communications, Inc. Full time $104,000 - $130,878 per yearWe're Hiring: Information Security Analyst – Incident Investigation Location:Cyber Security Operations CenterReports To:Cyber Security Incident Investigation and Threat Intel ManagerDivision:Cyber Security Investigation and Threat IntelAre you passionate about uncovering the root cause of security incidents and leading investigations that make a real...
-
Makati City, National Capital Region, Philippines Page Outsourcing RPO APAC for Sealed Air Full time ₱1,200,000 - ₱2,160,000 per yearThe Cybersecurity & Resilience department is dedicated to safeguarding information assets and mitigating cyber risks. Our focus is on incident response preparedness, operational excellence, and enhancing cyber resilience. As a member of this team, you will engage in readiness assessments, improve incident response processes, and elevate key performance...
-
Strategic Operations Lead
2 weeks ago
Makati City, National Capital Region, Philippines The Well Team Solutions Full time ₱480,000 per yearJob Title: Strategic Operations Lead - Build the Machine (Hybrid - Manila)Location: Makati, Manila (Hybrid Flexibility)Engagement: Full-Time | Compensation: A competitive package starting at approximately ₱40,000 per month, with a clear path to a higher base and performance-based bonuses.This is a foundational role. You will be the architect of our...
-
Security Analyst
3 weeks ago
Makati City, National Capital Region, Philippines Citco GSGS Full timeAbout CitcoCitco is a global leader in fund services, corporate governance and related asset services with staff across 80 offices worldwide. With more than $1 trillion in assets under administration, we deliver end-to-end solutions and exceptional service to meet our clients' needs.For more information about Citco, please visit www.citco.comAbout the Team &...
-
Business Intelligence Engineer
4 weeks ago
Makati City, National Capital Region, Philippines Metrobank Full timePress Tab to Move to Skip to Content LinkPosition Title : Business Intelligence Engineer As a Business Intelligence Engineer at Metrobank, you will gain the following career advantages:Contribute to the building of an end-to-end pioneer data science and advanced analytics team.Exposure to intricacies and dependencies of data operations and machine learning...
-
Business Intelligence Engineer
4 days ago
Makati City, National Capital Region, Philippines Metrobank Full time ₱900,000 - ₱1,200,000 per yearPosition Title: Business Intelligence Engineer As a Business Intelligence Engineer at Metrobank, you will gain the following career advantages: Contribute to the building of an end-to-end pioneer data science and advanced analytics team.Exposure to intricacies and dependencies of data operations and machine learning models in a highly regulated...
-
Security Operations Center Analyst
4 days ago
Makati City, National Capital Region, Philippines MEGALINK, INC Full time ₱30,000 - ₱60,000 per yearA Level 1 SOC Analyst is the first line of defense in a Security Operations Center (SOC). Monitor and respond to security alerts, ensuring the organization's digital assets remain safe.Key Responsibilities:Alert Triage and MonitoringReview security alerts generated by SIEM (Security Information and Event Management) systems and other monitoring...