The posting
The Cybersecurity Analyst supports day-to-day cybersecurity operations and the implementation of security initiatives through monitoring, platform administration, evidence collection, testing, documentation, and coordination. Working under established procedures and the technical guidance of the Senior Security Engineer, the role helps maintain security controls, identify potential risks, and improve operational effectiveness while progressively developing technical proficiency and ownership of assigned security processes.
DUTIES AND RESPONSIBILITIES:
I. Security Operations & Case Support
- Review security alerts, service tickets and user-reported security concerns using approved playbooks; document findings and escalate based on severity and procedure.
- Support incident coordination, evidence gathering, timelines, action tracking and closure documentation.
- Track managed SOC/MDR cases, verify required information is available and follow up on agreed actions and service levels.
- Maintain operational dashboards, recurring reports and metrics with clear source evidence
II. Security Platform Administration
- Perform approved routine administration, health checks, access reviews, inventory updates, policy verification and evidence collection for assigned security tools.
- Support onboarding of users, assets, log sources and integrations using documented procedures and change controls.
- Validate that alerts, logs and reports are being generated as expected; escalate data-quality or platform issues to the lead or vendor.
- Maintain accurate runbooks, knowledge articles, configuration records and operational checklists
III. Identity, PAM & Access Governance Support
- Support privileged account discovery, onboarding, owner validation, entitlement reviews and access recertification activities.
- Assist with PAM testing for vaulting, credential rotation, session recording, JIT access and approved remote-access use cases.
- Track identity and privileged-access exceptions, aged actions and required approvals.
- Support investigations of suspicious sign-ins or access activity under established procedures
IV. Endpoint, Device & Email Security Support
- Monitor endpoint and email security consoles, triage routine events, gather evidence and escalate confirmed or complex cases.
- Support endpoint coverage checks, policy validation, device compliance reporting and controlled pilot testing for Intune/MDM or EDR improvements.
- Assist with Mimecast and Microsoft email-security administration, testing, user-reported email analysis and documentation.
- Track remediation actions with Infrastructure, workplace technology and system owners.
V. Data Protection & Compliance Operations
- Support DLP and information-protection pilots, test cases, alert review, evidence collection and policy-tuning analysis under approved guidance.
- Maintain inventories of labels, policies, exceptions, owners and test results for Microsoft Purview or related controls.
- Coordinate with data owners and business stakeholders to validate legitimate activity and route possible violations for review.
- Support audit, control-testing and compliance evidence requests
VI. Vulnerability & Exposure Management Support
- Consolidate scan and assessment results, validate asset ownership and maintain remediation trackers. Prepare recurring exposure reports, aging views and follow-up lists based on approved prioritization criteria.
- Coordinate evidence of remediation and retesting with Infrastructure, application teams, vendors and asset owners.
- Escalate critical, overdue or unowned findings to the Senior Security Engineer and Cybersecurity Operations Head.
Preferred Qualifications:
- Bachelor's degree in Information Technology, Computer Science, Cybersecurity, Information Security, Engineering, or a related field. Equivalent practical experience may be considered. At least two (2) years of relevant experience in cybersecurity, IT operations, systems administration, network support, cloud support, or a related technical role.
- Foundational understanding of security concepts, including least privilege, MFA, endpoint protection, phishing, vulnerabilities, logging, and incident handling.
- Ability to follow procedures, analyze evidence, document findings, and manage assigned actions reliably.
- Practical exposure through work, internship, laboratory exercises, or projects involving Microsoft 365, Entra ID, Defender, Purview, MDM, EDR, SIEM, vulnerability scanners, or email-security platforms is an advantage.
- Basic knowledge of cybersecurity controls, security monitoring, identity and access management, endpoint protection, and vulnerability management.
- Good analytical, troubleshooting, documentation, and organizational skills.
- Effective communication and coordination skills when working with technical teams, business stakeholders, and service providers.
- Basic PowerShell, Python, API, reporting, or data analysis skills are an advantage.
- Willingness to learn new security technologies and progressively take ownership of assigned tools and processes.
- Security monitoring and basic alert analysis.
- Security platform administration and operational support.
- Identity, privileged access, endpoint, email, and data-protection controls.
- Vulnerability tracking, remediation coordination, and reporting.
- Evidence collection, technical documentation, and compliance support.
- Problem-solving, attention to detail, accountability, and continuous learning.
- Relevant entry-level certifications, or active progress toward certifications such as CompTIA Security+, ISC2 Certified in Cybersecurity (CC), Microsoft SC-900, AZ-900, or equivalent, are an advantage.
_______________________
About CITADEL Pacific
CITADEL Pacific Ltd. (CPL) is a diversified private holding company with operations in the Philippines, Hong Kong, Macau, the Republic of Palau, the Commonwealth of the Northern Mariana Islands, and the US Territory of Guam.
Our holdings range from controlling stakes in companies engaged in telecommunications, retail, petroleum and gas distribution, commercial, and industrial property, in-flight catering, and manpower services. Recent acquisitions entering Solar and Data Center businesses position CITADEL to future facing and fast-growing industries in renewables energy and digital infrastructure. Our recent acquisitions of Solar and Data Center businesses position CITADEL in future-facing, fast-growing industries within the renewable energy and digital infrastructure sectors.
We offer a competitive total rewards package which includes a base salary determined by factors such as role, experience, skill set, and location. Additionally, eligible employees may receive discretionary bonuses based on both company performance and individual achievements. Our benefits and programs are designed to meet the needs of our employees and are benchmarked to the market. Detailed information regarding compensation and benefits will be shared during the hiring process.
