Cyber Security Operations Center (CSOC) Analyst (English Speaker)

BTSE; Jakarta Pusat; Hybrid; IDR 150,000,000 - 230,000,000; Full time

Benefits offered by this job

Competitive total compensation package

Various team-building programs and公司与社

And many more!

Job summary

BTSE is seeking a Cyber Security Operations Center (CSOC) Analyst with 3-4 years of security monitoring and incident response experience to join a lean, high-ownership security team. You'll work with our MSSP and internal engineering teams to turn threat intel into action, write detection logic, and own incidents end-to-end.

You will develop detection rules, validate use cases, and contribute to insider threat monitoring while ensuring proper documentation and playbooks are in place.

Qualifications

• Bachelor's degree in Cybersecurity, IT, CS, or related field.
• 3-4 years in a SOC or equivalent security monitoring/detection engineering role.
• Hands-on with SIEM rule development and query writing (ES/QL, EQL, KQL).
• Ability to read raw logs and perform incident triage and enrichment.
• Proficiency in Python scripting for automation and tooling.
• Familiarity with MITRE ATT&CK and incident response frameworks (NIST/SANS).
• Experience with cloud security across AWS/Azure/GCP.

Responsibilities

• Triage, analyze, and escalate security alerts across SIEM, EDR/XDR, WAF, email security, and cloud logs.
• Own incidents end-to-end and develop playbooks and updated detection logic.
• Develop, tune, and validate SIEM detection rules and run validation exercises.
• Convert threat intel and hunting queries into defined, actionable responses.
• Support insider threat monitoring and identity/privilege anomaly detection.
• Verify MSSP tooling works and onboarding of log pipelines.
• Document playbooks and rationale to preserve institutional knowledge.
• Contribute to automation to reduce repetitive triage tasks.
• Collaborate with internal stakeholders and regional partners.

Skills

SOC experience

SIEM

Python scripting

Cloud security

MITRE ATT&CK

Incident response

Education

Bachelor's degree in Cybersecurity/Information Technology/CS

Tools

SIEM platforms

EDR/XDR

WAF

Cloud logs

Job description

About BTSE

BTSE Group is a global leader in fintech and blockchain technology, anchored by three core business pillars: Exchange, Payments, and Infrastructure Development. Serving over 100 corporate clients worldwide, we provide white-label exchange and payment solutions. Our offerings encompass everything from exchange infrastructure hosting and development to custody, wallets, payments, blockchain integration, trading, and more. We are looking for talented professionals in marketing, operations, customer support, and other departments. The roles offered may be on-site, remote, or hybrid, in collaboration with our local partner.

About The Opportunity

We are seeking a Cyber Security Operations Center (CSOC) Analyst with 3-4 years of experience in security monitoring, detection engineering, and incident response to join a lean, high-ownership security team at a cryptocurrency exchange. You will work closely with our MSSP and internal engineering team to close gaps between raw alerting and actual risk reduction — turning threat intel feeds into action, validating that our detections actually work, and helping build out new programs like insider threat monitoring. This is not a pure alert-queue role: you'll be expected to write and improve detection logic, document your work so it survives beyond you, and take ownership of incidents end-to-end rather than handing off after triage.

Responsibilities

• Perform triage, analysis, and escalation of security alerts across SIEM, EDR/XDR, WAF, email security, and cloud log sources, coordinating with our MSSP where relevant.
• Own incidents end-to-end — triage through resolution through "what changed afterward" — and turn that work into documented playbooks and updated detection logic, not just closed tickets.
• Develop, tune, and validate SIEM detection rules (ES|QL/EQL/KQL or equivalent), including running detection validation exercises against existing use cases to confirm they actually fire.
• Convert threat intelligence feeds and scheduled hunting queries (e.g., lookalike domain alerts, anomalous auth events) from passive detection into defined, actionable response — closing the loop between "we saw it" and "we did something about it."
• Support the build-out of an insider threat monitoring program, including identity and privileged-access anomaly detection.
• Understand our detection tooling and log source pipelines (maintained day-to-day by our MSSP) well enough to confirm they're onboarded correctly and actually working — you're not expected to build or maintain this tooling yourself, but you need to be able to verify it.
• Track and report CSOC performance metrics (MTTD/MTTR, false-positive rates, MSSP SLA adherence) to support continuous improvement of operations.
• Write and maintain operational documentation, playbooks, and detection rule rationale so institutional knowledge isn't concentrated in one or two people.
• Contribute to automation of repetitive triage and enrichment work (scripting, workflow tools) to reduce manual toil across the team.
• Collaborate with internal stakeholders and regional partners, where Chinese language skills may be required.

Requirements

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related field.
• 3-4 years of experience in a Security Operations Center (SOC) or equivalent security monitoring/detection engineering role.
• Hands-on experience with SIEM tools, including: 1. Detection rule and use case development, and the ability to reason about whether a rule actually detects what it claims to (detection validation mindset, not just rule-writing). 2. Query/rule-writing experience in ES|QL, EQL, KQL, or equivalent. 3. Alert triage, enrichment, and case management with ticketing systems. 4. Comfort reading raw logs (auth events, CloudTrail-style audit logs, process trees) without relying solely on pre-built dashboards.
• Working knowledge of Python or similar scripting for automation, log parsing, or extending existing tooling — enough to pick up and modify scripts someone else wrote, not build from scratch.
• Knowledge of common attack techniques, malware behavior, and network security principles, with familiarity mapping detections to MITRE ATT&CK.
• Familiarity with incident response frameworks (e.g., NIST, SANS) and a track record of writing playbooks or documentation from real incidents.
• Exposure to identity/IAM log analysis or insider threat / UEBA concepts is a strong plus, given active program build-out.
• Good understanding of cloud security (AWS, Azure, or GCP) and comfort across varied operating systems (Windows, Linux, macOS).

Nice to Haves

• Familiarity with atomic-level adversary emulation using Atomic Red Team or equivalent framework, for the purpose of validating that detections fire as expected.
• Effective communication and documentation skills.
• Chinese language proficiency (reading, writing, and/or speaking) is a strong advantage.
• Relevant certifications (e.g., CISSP, GCIH, GCFA, CompTIA Security+, CySA+, CEH, or similar) are desirable.

Perks & Benefits

• Competitive total compensation package.
• Various team-building programs and company events.
• And many more!

We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses and identifying potential inconsistencies or verification signals in application materials based on available information. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.