Client Security Lead

This is a fully remote position, open to applicants in Philippines.

📋 Description

• Act as the designated technical security owner for a specific group of client accounts.

• Take responsibility for the effectiveness and ongoing enhancement of the MTDR service for the clients assigned.

• Serve as the two-way technical liaison between clients and Theos Defence’s SOC.

• Maintain an in-depth understanding of client architecture, asset inventory, and strategic plans.

• Lead monthly reviews addressing events of interest and improvements in security posture.

• Provide client context to SOC analysts and engineers while managing escalations.

• Conduct hypothesis-driven threat hunts based on Cyber Threat Intelligence (CTI), detection gaps, and ATT&CK-mapped attack methodologies.

• Convert threat intelligence, indicators, and tactics, techniques, and procedures (TTPs) into actionable detection logic.

• Audit, refine, and enhance detection rules to minimize alert noise.

• Identify misconfigurations, Active Directory risks, and non-functioning baseline controls, assisting clients in their remediation.

• Investigate significant incidents by correlating telemetry from endpoints, identities, cloud, and networks.

• Develop incident timelines, assess blast radius, and conduct root-cause analyses.

• Support active compromise assessments and incident response efforts by providing environmental context, hunting queries, and detection logic.

• Execute investigation quality checks and mentor junior analysts.

• Utilize analyst pain points to drive improvements in detection engineering.

⛳️ Requirements

• Experience in building, tuning, and retiring detection rules within major SIEM/XDR platforms.

• Direct experience with Microsoft Sentinel or CrowdStrike Falcon is advantageous.

• Strong proficiency in querying another SIEM/XDR platform is acceptable.

• Capability to independently write complex detection logic.

• Ability to assess detection-rule trade-offs between alert fatigue and potential missed edge cases.

• Background in threat hunting or incident response is essential.

• Experience managing hunts and incidents from initial signal through to root cause analysis.

• Ability to structure hunts around testable hypotheses and identify contradicting evidence.

• Proficient in correlating endpoint, identity, cloud, and network logs to reconstruct timelines and assess blast radius.

• Working knowledge of at least one major cloud or identity ecosystem: Microsoft Azure, Entra ID, M335, or AWS.

• Ability to trace cloud audit and sign-in logs and relate activity to endpoint actions.

• Understanding of real-world cloud and identity attacks, such as password spraying, consent phishing, and excessive permission abuse.

• Capability to communicate effectively with senior leadership, technical teams, and non-technical decision-makers.

• Proficient in writing clear, professional client-facing documentation.

• Ability to quickly map unfamiliar technical environments and keep an updated mental model.

• Experience in multi-account MSSP/consulting is a plus, but not mandatory.

• Background in formal incident response or compromise assessment is a plus, but not required.

• Skills in Python or PowerShell are a plus, but not mandatory.

• Practical understanding of AI/AI Agent security risks and new attack vectors is a plus, but not required.

• Familiarity with Asia-Pacific threat actors, TTPs, and sector risks is a plus, but not required.

🏝️ Benefits

• Continuous Development of People.

• Remote work arrangement.

• Premium Security Services environment.

• Full-time employment.