Lead Incident Responder: Rapid Containment & Forensics

Lintasarta; Jakarta Pusat; On-site; IDR 300,000,000 - 600,000,000; Full time

Job summary

Lintasarta is seeking an experienced Incident Responder to join our Security Operations Center (SOC). You will lead responses to major security incidents, investigate complex breaches, and eradicate threats across enterprise environments.

Responsibilities include containment, eradication, remediation, and post-incident reporting. You will work with IT and Disaster Recovery teams and contribute to automated response playbooks while maintaining strict evidentiary standards.

Qualifications

• 4–6+ years of technical cybersecurity experience with 2–3 years in DFIR.
• Experience leading on major incidents (ransomware, exfiltration, BEC, cloud hijacking).
• Hands-on with forensic tools listed above.
• Advanced knowledge of EDR/XDR platforms for threat hunting and triage.

Responsibilities

• Lead incident response from confirmation to remediation under time pressure.
• Perform targeted eradication and removal of threats and malware payloads.
• Coordinate with IT Infrastructure and DR teams for safe restoration of systems.
• Conduct cross-OS forensic collection on Windows, Linux, macOS endpoints.
• Reconstruct attack timelines using cloud, identity, network, and app telemetry.
• Identify IoCs and attacker capabilities through malware analysis.
• Produce RCA and PIR reports for leadership and auditors.
• Translate findings into automated SOAR playbooks.
• Maintain chain-of-custody for regulatory and legal actions.
• Participate in on-call rotation.

Skills

DFIR experience

Forensic analysis

EDR/XDR experience

Log analysis

Scripting skills

MITRE ATT&CK knowledge

Decision making under pressure

Clear communication

Tools

KAPE

Velociraptor

Volatility

FTK Imager

EnCase

X-Ways Forensics

CrowdStrike Falcon

Microsoft Defender for Endpoint

Cortex XDR

Splunk

KQL

Job description

Lintasarta is seeking an experienced Incident Responder to join our Security Operations Center (SOC). You will lead responses to major security incidents, investigate complex breaches, and eradicate threats across enterprise environments.

Responsibilities include containment, eradication, remediation, and post-incident reporting. You will work with IT and Disaster Recovery teams and contribute to automated response playbooks while maintaining strict evidentiary standards.