Cybersecurity Incident Response Specialist
Summary
Senior escalation point on Metrobank's SOC in Metro Manila: investigates escalated security incidents (scope, impact, root cause), leads containment, eradication and recovery, analyzes malware/logs and threat intel, and produces reports, playbooks and metrics to improve the bank's security posture. Core areas: SIEM, incident response, forensics, Windows/Linux.
Be #InGoodHands with Metrobank!
Here at Metrobank, we don't simply hire employees—we hone future leaders. We provide opportunities that enhance your skills and unlock your talents, helping you evolve into a well-rounded individual. We supply you with all the pieces you need to do your best work, unleashing your full potential to help you secure your future and lead a fulfilling career. And with Metrobank's strong heart for the community, you have the chance to give back and make worthwhile contributions to our nation's economic and social development. With Metrobank, a meaningful life is within your reach!
The Cybersecurity Incident Response Specialist is responsible for investigating and managing escalated security incidents and conducting in-depth investigations to determine the scope, impact, and severity of security events. The role leads containment, eradication, recovery, and remediation efforts to minimize business risk and restore normal operations. It analyzes security data, identifies threat patterns, and provides actionable recommendations to prevent recurrence. The role also produces incident reports, playbook reviews, metrics, and insights to support the continuous improvement of the Bank's cybersecurity posture.
Key Responsibilities
- Serve as the primary escalation point for SOC Analysts and conduct in-depth investigations through data correlation, threat analysis, and root cause analysis to determine incident scope, risk, and severity.
- Provide guidance and oversight on incident containment, remediation, recovery, and resolution activities.
- Review incident tickets and ensure investigations conducted by SOC Analysts are thorough, accurate, and properly documented.
- Leverage threat intelligence to identify affected systems, determine attack scope, and assess potential impact.
- Document security incidents from initial detection through final resolution and closure.
- Develop, maintain, and enhance incident response playbooks.
- Stay current on emerging cyber threats, vulnerabilities, attack techniques, and applicable regulatory requirements.
- Support Threat Hunting activities by providing insights and recommendations for developing new threat detection and analytics methods.
- Analyze malware, network traffic patterns, and other security events to identify threats and recommend appropriate actions.
- Generate and submit incident reports, metrics, and operational reports on a daily, weekly, and monthly basis.
- Review security monitoring metrics and identify trends, anomalies, and opportunities for improving detection and response capabilities.
- Work closely with the SOC Manager to strengthen security operations and address identified process or control gaps.
- Participate in the evaluation, implementation, troubleshooting, and optimization of security tools and technologies.
- Perform other cybersecurity incident response and SOC-related duties as assigned by the SOC Manager.
Qualifications:
- Bachelor's degree in information security, Computer Science, Computer Engineering, or a related field.
- Minimum of 3-5 years of experience in Information Security, Incident Response, SOC Operations, Cybersecurity Operations, or a related field.
- Hands-on experience in security monitoring, SIEM operations, security event investigation, threat detection, and log analysis.
- Strong knowledge of incident response, digital forensics, malware analysis, root cause analysis, network security, and host-based investigations.
- Familiarity with Windows and Unix/Linux operating systems, authentication technologies, network protocols, and enterprise infrastructure environments.
- Understanding of cybersecurity frameworks, information security principles, risk management practices, and industry best practices.
- Knowledge of scripting, programming, system administration, and automation technologies is an advantage.
- Ethical hacking or penetration testing experience is an advantage.
- Strong analytical, investigative, problem-solving, communication, and stakeholder management skills.
- Ability to work in a 24x7 shift-based environment and support critical security incidents when required.
- Professional certifications such as CEH, CISSP, CISA, GSEC, CHFI, GCIH, GCFA, or equivalent are preferred.
Other Details: