Security Analyst L2

Ensign InfoSecurity; Jakarta Selatan; On-site; IDR 180,000,000 - 240,000,000; Full time

Job summary

Ensign InfoSecurity is seeking an experienced security operations professional to join our Jakarta SOC. You will monitor events, perform investigations, and develop detections and playbooks to improve threat visibility for clients.

The role requires at least 5 years in security operations, strong analytical skills, and familiarity with MITRE ATT&CK. You’ll collaborate with analysts, deliver data-driven reports, and share knowledge to enhance capabilities.

Qualifications

• Degree in a related field with minimum 5 years in security operations.
• Experience in SOC/CERT/CIRT environments and incident handling.
• Strong analytical and contextual reasoning with logs and indicators.
• Familiarity with MITRE ATT&CK framework and cyber kill chain.
• Preferred certifications in cyber security (GCIA, CEH, etc.).

Responsibilities

• Monitor and triage security events from networks, hosts, and logs.
• Perform detailed investigations and profiling of events against baselines.
• Develop and tune detection rules and playbooks in SIEM.
• Produce technical reports, briefings, and data feeds for stakeholders.
• Assist analysts and conduct knowledge sharing sessions.
• Research and characterize threats using OSINT and closed sources.

Skills

SOC Analysis

Threat Hunting

OSINT

MITRE ATT&CK

Log Analysis

Python scripting

Education

Bachelor's degree in Computer Science / Cyber Security

Tools

SIEM

Incident response tools

Job description

• Monitor third party security feeds, forums, and mailing lists to gather information related to the client through automated means
• Produce intelligence outputs to provide an accurate depiction of the current threat landscape and associated risk through the use of customer, community, and open source reporting
• Produce actionable intelligence information for delivery to colleagues and customers in the form of technical reports, briefings, and data feeds
• Review vulnerabilities advisories
• Review and process threat intelligence reports
• Perform detailed investigative works into all traffic anomalies against established, historical baselines of individual agencies. Reviewing and profiling the events of all monitored clients
• Assess each event based on factual information and wider contextual information available
• Review, propose and generate reports to automate or reduce low value event escalations
• Build rules and intelligence to detect such threats and proliferate to all monitored networks
• Implementing and devising detection method of such threats in our security operations through SIEM Rules, DB scripts etc
• Perform periodic analysis of security events, network traffic, and logs to engineer new detection methods, or create efficiencies when available
• Supports the development of tactics, techniques, and procedures in providing proactive threat hunting and analysis against the available information sources (e.g. Netflow, DNS and Firewall logs, etc.)
• Assist the Security Analysts with the investigative works
• Prepare training programme for Security Analyst and conduct knowledge sharing sessions for Security Analyst
• Fulfil Change Requests, Service Requests and respond to internal / external enquiries with regards to detection Use Case
• Any other tasks as assigned

Requirements

• Degree holder with at least 5 years' of experience in related field and capacity
• Prior experience working in a Security Operations Centre (SOC) or Computer Emergency Response Team (CERT/CIRT)
• Possessed deep interest in open source research and critical thinking / contextual analysis abilities
• Has proper understanding of network, apps,and server fundamentals, and be able to identify and analyze logs thoroughly by looking at the indicators
• Has understanding of MITRE ATT&CK framework or cyber kill chain
• Investigative and analytical problem solving skills
• An understanding of the current vulnerabilities, response, and mitigation strategies used in cyber security
• Related professional cyber security certification, such as GCIA, CEH, will be preferred
• Experience with intelligence analysis processes, including Open Source Intelligence (OSINT) and closed source intelligence gathering, source verification, data fusion, link analysis, and threat actor
• Ability to research and characterize security threats to include identification and classification of threat indicators