Security Engineer (Cybersec) On-site

As Cyber Security Engineer you will design, build, and harden the security controls that protect our games, platforms, and player data. You will work across cloud, network, application, and endpoint domains to translate threats into engineered defenses. Needless to say, you must have a strong track record in security engineering and be ready to tackle a new challenge in an exciting environment.

About the Role

• Design, deploy, and continuously improve security controls across our environments, including network segmentation, IAM hardening, secrets management, and key management.
• Drive Application, Development & Code Security across all engineering teams, including secure coding standards, threat modeling, and security architecture reviews.
• Embed security into the SDLC by integrating SAST, DAST, SCA, secret scanning, and IaC scanning into CI/CD pipelines and partnering with engineering teams on secure design reviews and threat modeling.
• Identify, prioritize, and help remediate vulnerabilities in applications, APIs, and third-party dependencies; track them to closure together with the responsible development teams.
• Conduct internal penetration tests, threat modeling sessions, and security design reviews for new and existing services.
• Engineer and tune detections within our SIEM/XDR stack (Wazuh, InsightIDR) and build SOAR playbooks that automate triage, containment, and response.
• Monitor and analyze trends, security logs, and alerts from Threat Prevention, firewalls, network appliances, Linux servers, Web Application Firewalls, DDoS and API attacks, identity management, Microsoft AntiSpam, Microsoft Identity Protection, etc. to identify and mitigate security incidents.
• Harden Linux servers, Kubernetes clusters, WAF, DDoS, and API protection layers; perform configuration reviews against CIS benchmarks and close the gaps.
• Support incident response as a hands-on responder: investigate alerts, perform forensics, contain incidents, and drive post-incident actions to prevent recurrence.
• Work with all departments (Engineering, Operations, IT, Product, Legal & Compliance) to define and implement security requirements, controls, and processes.
• Build internal security tooling and automation (Python, bash, Terraform) to scale the security function and reduce manual effort.

Requirements

• Solid experience in Application Security: secure SDLC, OWASP Top 10, OWASP ASVS, threat modeling (e.g., STRIDE), and API security.
• Solid experience securing cloud environments, ideally GCP.
• Hands-on experience with SAST, DAST, SCA, IaC, and container scanning tools (e.g., SonarQube, Semgrep, Snyk, Trivy, OWASP ZAP, Burp Suite).
• Strong programming and scripting skills (e.g., Python, Bash, Go, Java, JavaScript/TypeScript) and the ability to read and review code across multiple languages.
• Experience with CI/CD pipelines (GitLab CI, GitHub Actions, Jenkins) and embedding security checks into them.
• Experience operating and tuning Wazuh (or comparable SIEM/XDR solutions), including log sources, decoders, rules, and dashboards.
• Solid understanding of cloud security (AWS, GCP) and Microsoft 365 security controls.
• Familiarity with security frameworks (e.g., ISO 27001, NIST, CIS, OWASP) and their implementation and auditing.
• Knowledge of network security, Identity & Access Management (IAM, PAM), authentication protocols (OAuth2, OIDC, SAML), and cryptography basics.
• Experience with vulnerability management, penetration testing concepts, and structured remediation workflows.
• Familiarity with container and orchestration security (Docker, Kubernetes) and Infrastructure as Code (Terraform, Ansible) is a plus.

Benefits

• Join a diverse, international team of colleagues from over 30 countries, where shared goals and a variety of perspectives make us stronger
• Take on meaningful challenges that come with real responsibility and plenty of room to grow in our dynamic environment 
• Dress comfortably! We keep things casual here, so you’re free to wear what feels right for you
• Benefit from mandatory government contributions, including SSS, PhilHealth, and Pag-IBIG, for your peace of mind
• Make work more fun with exciting company events like our annual Halloween party, Christmas celebration, and team outings
• Recharge with an additional 3 Wellness days throughout the year, next to the statutory vacation days and public holidays
• Enjoy health insurance upon regularization to keep you and your loved ones protected
• Receive your 13th Month Pay and Overtime Pay as part of a fair and rewarding package