SOC Manager

Salmon is a technology-driven financial company building a banking and lending platform across Southeast Asia, starting in the Philippines.

We combine global fintech expertise with deep local market knowledge to make financial services simple, accessible, and useful for millions of people across the region.

7M+ app downloads. 2M+ monthly active users. 7,000+ partner stores. US$310M+ raised from leading global investors.

Manila-based, globally distributed, and hybrid-first — our team spans 45+ countries.

If you want to solve complex problems at scale and impact how millions of people access and manage money, come build with us.

Southeast Asia's fintech moment starts here.

You'll own Security Operations at group level across a regulated bank, consumer finance business, and shared technology platform, working directly with the Group CISO.

Set the direction for monitoring, detection, and response across cloud, identity, endpoints, SaaS, and containerised environmentsLead the technical response during significant cyber incidents and coordinate the teams involvedSelect, manage, and hold MSSP/MDR providers accountable, deciding when to build in-house versus buy

What you'll own

Own the monitoring architecture and telemetry strategy: SIEM design, data sources, retention, forensic readiness, and telemetry cost managementDefine the threat scenarios that matter most to Salmon, maintain detection coverage against them, and drive threat hunting and detection validation using MITRE ATT&CKOwn incident readiness — playbooks, escalation, forensic readiness, post-incident reviews, and tabletop exercises — and take part in complex investigations hands-on, including KQL and telemetry analysisOwn Vulnerability and Exposure Management, setting remediation priorities and expectations and governing the risk acceptance process for exceptionsOwn the operational side of DLP and selected access governance controls, including SSO coverage, privileged access monitoring, and access reviewsSet priorities for the Security Operations team and vendors, define metrics on coverage, detection quality, response performance, and provider performance, and own technical readiness for BSP and PCI DSS assurance activities

What makes you a strong fit

Practical experience managing MSSP/MDR or other security service providers, including selection, negotiation, escalation, or replacementHands-on depth with Microsoft Sentinel and KQL, and experience with Microsoft Defender XDR / Defender for EndpointWorking knowledge of Microsoft 365 security and audit telemetry, identity and access telemetry, and cloud security monitoring in complex environmentsExperience with containerised platforms and workloads, and with SIEM data flows, retention, tiering, and cost managementTrack record of independently assessing a security function, prioritising against risk and cost, and leading through serious incidents with incomplete informationComfortable communicating with engineers, providers, the CISO, senior management, Risk, and Internal Audit

What we offer

Ownership and flexibility

Fully remote work with core collaboration hours from 12:00 to 6:00 PM Manila time (UTC+8)Company-provided tools and equipment

Health and time off

Medical insurance support for you and your family through co-funding or reimbursement, depending on your location and subject to policy limitsAccess to an internal mental health support specialist22 vacation days, Philippine public holidays, and 15 sick days

Growth and team experience

Opportunities to learn and share your expertise through internal expert meetups, external conferences, speaking opportunities, and industry publicationsCompany-sponsored trips to Manila to meet and work with your team in personHigh-performing teams can earn a dedicated beach house week in Southeast Asia

We believe strong teams are built by people with different backgrounds, experiences, and points of view. Salmon is an equal opportunity employer, and we make hiring decisions based on skills, experience, and potential.