Client Security Lead

THEOS Cyber

. Serve as the named technical security owner for a defined set of client accounts .

Posted 10/20/2026full-timeRemote • PhilippinesSeniorWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in technical security ownership, incident response, and threat hunting, with a strong ability to translate threat intelligence into actionable detection logic. Proficient in managing client relationships and improving security postures through effective communication and technical guidance.

Highest-signal resume keywords

Detection Rule DevelopmentThreat Hunting ExperienceIncident Response ExpertiseSIEM/XDR Platform ProficiencyCloud Security Knowledge

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Detection Rule TuningThreat Intelligence AnalysisHypothesis-Driven Threat HuntsIncident Timeline ConstructionDetection Logic WritingLog CorrelationCloud Audit AnalysisSecurity Posture EnhancementRoot-Cause AnalysisAlert Fatigue Evaluation

Soft Skills

Client CommunicationMentoring Junior AnalystsTechnical Documentation WritingProblem-SolvingCollaboration with Technical Teams

Tools & Technologies

Microsoft SentinelCrowdStrike FalconSIEM PlatformsXDR PlatformsMicrosoft AzureEntra IDAWSPythonPowerShellAI Security Risk Understanding

Industry Keywords

MSSP ExperienceCompromise AssessmentAsia-Pacific Threat ActorsTTPsSecurity Operations Center (SOC)

Tech Stack

Tools & technologies

AWSAzureCloudPython

About the role

Key responsibilities & impact

Serve as the named technical security owner for a defined set of client accounts
Own the effectiveness and continuous improvement of the MTDR service for assigned clients
Act as the two-way technical interface between clients and Theos Defence’s SOC
Maintain deep knowledge of client architecture, asset inventory, and strategic roadmap
Lead monthly reviews covering events of interest and security posture enhancements
Bring client context to SOC analysts and engineers and handle escalations
Conduct hypothesis-driven threat hunts based on CTI, detection gaps, and ATT&CK-mapped attack paths
Translate threat intelligence, indicators, and TTPs into actionable detection logic
Audit, tune, prune, and improve detection rules to reduce alert noise
Identify misconfigurations, AD risks, and broken baseline controls and help clients remediate them
Investigate major incidents by correlating endpoint, identity, cloud, and network telemetry
Construct incident timelines, blast-radius assessments, and root-cause analyses
Support active compromise assessments and incident response engagements with environment context, hunting queries, and detection logic
Perform investigation quality checks and mentor junior analysts
Use analyst pain points to drive detection-engineering improvements

Requirements

What you’ll need

Experience building, tuning, and retiring detection rules in major SIEM/XDR platforms
Direct experience with Microsoft Sentinel or CrowdStrike Falcon is a plus
Strong query fluency on another SIEM/XDR platform acceptable
Ability to write non-trivial detection logic independently
Ability to evaluate detection-rule trade-offs between alert fatigue and missed edge cases
Experience in threat hunting or incident response
Experience owning hunts and incidents from initial signal through root cause
Ability to structure hunts around testable hypotheses and identify disconfirming evidence
Ability to correlate endpoint, identity, cloud, and network logs to reconstruct timelines and blast radius
Working knowledge of at least one major cloud/identity ecosystem: Microsoft Azure, Entra ID, M335, or AWS
Ability to trace cloud audit and sign-in logs and map activity to endpoint activity
Understanding of real-world cloud/identity attacks, including password spraying, consent phishing, and excessive permission abuse
Ability to communicate with senior leadership, technical teams, and non-technical decision-makers
Ability to write crisp, professional client-facing documentation
Ability to quickly map unfamiliar technical environments and maintain an updated mental model
Multi-account MSSP/consulting experience is a plus, not required
Formal incident response or compromise assessment background is a plus, not required
Python or PowerShell skills are a plus, not required
Practical understanding of AI/AI Agent security risks and novel attack vectors is a plus, not required
Familiarity with Asia-Pacific threat actors, TTPs, and sector risks is a plus, not required

Benefits

Comp & perks

Continuous Development of People
Remote work arrangement
Premium Security Services environment
Full-time employment