Skip to content

SecOps & IR

Cyber Defence Specialist

CyberOne logoCyberOneRemote in PhilippinesFull-timePosted 1d ago
Apply on CyberOne (shows the role here)CyberOne as an employer: salaries and roles

The full posting

About CyberOne

CyberOne is a pure-play Microsoft security partner dedicated to helping enterprises realise the full value of the Microsoft Security portfolio - across Defender XDR, Sentinel, Entra, Purview, Intune, Copilot for Security and more. We combine deep technical expertise with outcome-driven services that accelerate secure cloud adoption, modernise threat protection and simplify compliance.

Job Title:Cyber Defence Specialist

Location:Remote

Employment Type:Full time

Reports to: Senior SecOps Lead

Schedule: **** Rotational Shift

The Role

The Cyber Defence Specialist provides specialist technical expertise across security operations centre, major incident response, and organic threat hunting. Acting as the technical escalation point for Senior Cyber Defence Analysts, the role investigates advanced adversary activity. The specialist works closely with Incident Response team to translate investigation and threat hunting findings into improvements to CyberOne's cyber defence capabilities.

Responsibilities

  • Act as the Level 3 technical escalation point for complex incidents requiring specialist investigation beyond Level 2 analysis.
  • Handle the specialist technical investigation of major incidents and advanced adversary activity, working under the Incident Response Lead during formal response engagements.
  • Determine incident scope, attack paths, persistence mechanisms, and affected assets through detailed analysis of available security telemetry.
  • Provide technical recommendations for containment, eradication, and recovery in accordance with agreed customer authorisation and response procedures.
  • Conduct organic threat hunting across customer environments, driven by new threat intelligence, threats identified by CyberOne, and post-incident findings or detection gaps, to identify previously undetected threats, determine scope and impact, and validate detection coverage.
  • Provide investigation findings and technical recommendations to Engineering and Detection Engineering teams on visibility gaps, detection logic, and response workflows, with resolution and implementation remaining the responsibility of those teams.
  • Document specialist investigation findings, technical recommendations, and lessons learned to support incident reporting and service improvement.
  • Provide technical guidance to Level 1 and Level 2 analysts and maintain specialist investigation playbooks and knowledge articles.

Where you can be based

This position is 100% remote and open to applicants based in Philippines.

Text as CyberOne published it; last compared with the original on 13 Nov 2026.

Apply on CyberOne (shows the role here)

The application

Your details and CV, then 3 questions (1 written).

Keep these to handCVOther files (optional)Cover letter (optional)
  1. 1.
    Are you based in the PhilippinesYes or no
  2. 2.
    When are you available to start?Short answer
  3. 3.
    What is your expected salary?Written answer

Taken from CyberOne's application form as it stood on 13 Nov 2026.

The employer: CyberOne

CyberOne runs managed detection, incident response and consulting on Microsoft security tools, and is filling SOC, incident response and engineering roles in London and Manila.

Pay and benefits: Full-time staff roles; the SOC posts in the Philippines run on rotational shifts.

Full postings from CyberOne All CyberOne openings on the board CyberOne employer profile

Other security roles worth a look

Let security teams come to you

Security teams sometimes ask us directly for someone with a given specialty, clearance or certification. Join the candidate pool once and we put you forward when a brief matches, and only after you say yes. No cost to you.

Create my profile

Hear first when CyberOne posts a security role

We read CyberOne's careers system around the clock and send its new security roles in a weekly email, along with comparable openings at other employers. Free; leave whenever you like.