Security Engineer

Yourpay; Jakarta Pusat; On-site; IDR 250,000,000 - 420,000,000; Full time

Job summary

YOUR! in Indonesia is building a security operations function focused on Detection & Response.

We seek a Security Engineer to establish the SOC foundation, onboard telemetry, and implement SIEM with emphasis on detection across cloud, applications, and infrastructure. The role includes developing detection use cases, tuning rules to reduce false positives, incident response playbooks, threat hunting, and collaborating with Infra and Engineering to strengthen security visibility in a fast-growing

Qualifications

• Hands-on experience in Security Operations, Detection Engineering, Incident Response, or Security Engineering.
• Experience implementing or building SIEM/security monitoring capabilities from the ground up.
• Strong understanding of log aggregation, parsing, normalization, correlation, and detection engineering.
• Experience developing and tuning SIEM detection rules and security use cases.
• Strong understanding of MITRE ATT&CK and translating attack techniques into detection logic.
• Experience investigating security events across cloud, network, application, endpoint, and identity environments.

Responsibilities

• Design and implement the SIEM and centralized security monitoring platform from the ground up.
• Identify, onboard, normalize, and maintain security telemetry from Cloudflare/WAF, API Gateway, applications, cloud, infrastructure, IAM, endpoints, and other critical systems.
• Define logging and telemetry requirements to ensure visibility across critical systems.
• Develop SIEM correlation rules, detection use cases, and alerting logic based on real-world scenarios.
• Continuously tune logs, detection rules, and alerts to improve accuracy.
• Develop security dashboards and metrics covering telemetry coverage and MTTR, alert quality.
• Investigate security alerts; conduct threat analysis, incident investigation, and root cause analysis.
• Develop and maintain incident response playbooks and response procedures.
• Perform threat hunting to identify suspicious activities beyond existing detections.
• Work with Infrastructure and Engineering on containment and remediation.
• Identify security visibility gaps and improve detection coverage across the environment.

Skills

Security Operations

Detection Engineering

Incident Response

Security Engineering

SIEM knowledge

Threat hunting

Cloud security

Log aggregation

MITRE ATT&CK

Python scripting

Tools

Splunk

Elastic

Wazuh

AlienVault

Security Onion

EDR/XDR

Job description

YOUR! (formerly Yourpay) is a neobank focused on empowering and transforming the lives of underbanked mothers and families in rural areas of Indonesia. Our goal is to provide secure, affordable, and user-friendly financial services to Indonesian migrant workers around the world. We offer a comprehensive platform for payments, transfers, lending, and savings, allowing users to access five pillars of financial transactions: payment, lending, insurance, investment, and saving. To date, we have served over 2 million transactions for more than 60,000 active users in Indonesia, Taiwan, Hong Kong, Singapore, and soon Malaysia and Saudi Arabia. Join us in revolutionizing financial inclusion and making a positive impact on communities.

Role Summary

We are seeking a Security Engineer focused on Detection & Response to build and strengthen our security monitoring, detection, and response capabilities from the ground up.

You will be responsible for building the technical foundation of our SOC, from identifying and onboarding security logs, implementing and tuning SIEM, developing detection use cases, correlating security events, to investigating and responding to security incidents.

You will work closely with Infrastructure and Engineering teams to improve security visibility, detection coverage, and response capabilities across our environment.

Responsibilities

• Design and implement the SIEM and centralized security monitoring platform from the ground up.
• Identify, onboard, normalize, and maintain security telemetry from Cloudflare/WAF, API Gateway, applications, cloud, infrastructure, IAM, endpoints, and other critical systems.
• Define and maintain logging and telemetry requirements to ensure sufficient visibility across critical systems.
• Develop SIEM correlation rules, detection use cases, and alerting logic based on real-world attack scenarios and security risks.
• Continuously tune logs, detection rules, and alerts to improve detection accuracy and reduce false positives.
• Develop security monitoring dashboards and metrics covering telemetry coverage, detection coverage, MTTD, MTTR, and alert quality.
• Investigate security alerts and conduct threat analysis, incident investigation, and root cause analysis.
• Develop and maintain incident response playbooks and response procedures.
• Perform threat hunting to proactively identify suspicious activities that may not trigger existing detections.
• Work with Infrastructure and Engineering teams on containment, remediation, and preventive controls based on identified threats.
• Identify and continuously improve security visibility and detection gaps across the environment.
• Evaluate and implement security technologies that improve detection, investigation, and response capabilities.

Requirements

• Hands-on experience in Security Operations, Detection Engineering, Incident Response, or Security Engineering.
• Experience implementing or building SIEM/security monitoring capabilities from the ground up.
• Strong understanding of log aggregation, parsing, normalization, correlation, and detection engineering.
• Experience developing and tuning SIEM detection rules and security use cases.
• Strong understanding of MITRE ATT&CK and the ability to translate attack techniques into detection logic.
• Experience investigating security events across cloud, network, application, endpoint, and identity environments.
• Hands-on experience with incident response, threat hunting, and root cause analysis.
• Ability to analyze large volumes of logs and identify relevant security telemetry and detection opportunities.
• Familiarity with security telemetry from WAF, API Gateway, EDR/XDR, IAM, Kubernetes/container platforms, cloud services, and applications.
• Experience with SIEM platforms such as Splunk,Security Onion, Elastic, Wazuh, AlienVault, or equivalent.
• Scripting/automation experience using Python, Bash, or similar is a plus.
• Familiarity with security frameworks such as MITRE ATT&CK, NIST CSF, CIS Controls, ISO 27001, and OWASP.
• Familiarity with Indonesian regulatory requirements such as OJK, Bank Indonesia, and PDP Law is a plus.
• Strong analytical and problem-solving skills with the ability to investigate ambiguous security events.
• Strong communication and collaboration skills to work with Infrastructure and Engineering teams.