T

Twoconnect

IT Security Analyst

Security Operations & Incident ResponseConfirmed live in the last 24 hours
Full-timeRemote in PhilippinesNo salary listed

About the Job

Requirements

  • At least 3 years of relevant experience in cybersecurity operations, incident response, or an IT role with substantial hands-on security responsibilities.
  • Practical experience securing Microsoft enterprise environments and investigating threats using Microsoft Defender for Endpoint or equivalent endpoint detection and response tooling.
  • Hands-on experience with Active Directory, Microsoft Entra ID, multifactor authentication, Conditional Access, and access reviews.
  • Experience working with a security information and event management system and a managed security operations center or managed detection and response provider.
  • Working knowledge of Essential Eight implementation or assessment and ITIL-aligned IT service management processes.
  • Strong knowledge of Microsoft 365 and Windows security, including Exchange Online, Windows endpoints, and Windows Server.
  • Experience with log analysis and threat investigation, including common attack techniques, phishing, and ransomware.
  • Sound understanding of networking fundamentals, including TCP/IP, DNS, firewalls, and VPNs.
  • Relevant qualifications in cybersecurity, information technology, or a related discipline, or equivalent practical experience.
  • Strong analytical judgment, problem-solving ability, and clear written and verbal communication skills.
  • Ability to prioritize competing incidents and handle sensitive information with discretion and accountability.

Responsibilities

  • Triage and investigate Microsoft Defender alerts and Arctic Wolf security operations center escalations, including phishing, malware, suspicious sign-ins, and endpoint activity.
  • Coordinate containment, eradication, and recovery activities with Arctic Wolf and internal IT teams, maintain incident evidence, and escalate major incidents where required.
  • Support Microsoft Defender endpoint protection, Microsoft 365 security posture, security hardening, and endpoint detection and response.
  • Prioritize vulnerabilities based on exploitability, exposure, and business criticality, and track remediation through to closure.
  • Support security baselines and patch compliance using Microsoft management tools and NinjaOne where applicable.
  • Review and strengthen Active Directory and Microsoft Entra ID security, including multifactor authentication, Conditional Access, least-privilege access, and periodic access reviews.
  • Review privileged accounts, role-based access, service accounts, and application permissions, and support identity-related threat response.
  • Support improvement of Essential Eight controls, maintain evidence and remediation actions, and work with control owners to verify implementation.
  • Support security risk assessments, policy reviews, and audits, translating identified control gaps into prioritized actions.
  • Record and manage security incidents, requests, problems, and changes in Freshservice in line with agreed IT service management processes.
  • Perform root cause analysis, maintain response playbooks and knowledge articles, and support continuous improvement of recurring security issues.
  • Report on incident response, remediation aging, Defender coverage, identity risks, and Essential Eight progress.
  • Collaborate with service desk, infrastructure, application, and business teams to resolve security issues while supporting operational continuity.
  • Provide practical security guidance and contribute to phishing awareness and user education.
  • Support incident handovers across time zones and participate in agreed after-hours incident response arrangements when required.
  • Perform other position-level duties as they arise.

Desired Qualifications

  • Arctic Wolf experience.
  • Freshservice experience.
  • PowerShell or Kusto Query Language (KQL) experience for investigation and automation.
  • Exposure to Intune, Defender for Office 365, and Defender for Identity.
  • Experience within global or multi-site operations.
  • Relevant Microsoft security or identity certifications, CompTIA Security+, ITIL Foundation certification, or Essential Eight assessment training.

About the Company

Twoconnect

Company size
Not listed
Company stage
Not listed
Total funding
Not listed
Headquarters
Not listed
Founded
Not listed

Recently Posted Jobs

Explore more opportunities at Twoconnect

See more jobs