Security Engineer (Onsite – Customer Premises)

Securxcess; Kota Medan ᯔᯩᯑᯉ᯲; On-site; IDR 150,000,000 - 210,000,000; Full time

Job summary

A cybersecurity company in Medan is seeking an onsite Security Engineer to monitor network threats and respond to incidents. The role requires a Bachelor's degree in IT, at least 1 year of experience, and proficiency in network analysis tools. Candidates should also understand various protocols and possess scripting skills. This position involves deep packet inspection and collaboration with SOC teams for incident management.

Qualifications

• Minimum 1 year of experience as a Security Engineer or related role.
• Understanding of NDR and SIEM operations.
• Strong understanding of TCP/IP and common application protocols (DNS, HTTP/S, SMB, DHCP).
• Hands‑on experience with network analysis tools such as Wireshark or tcpdump.
• Familiarity with open-source tools (Zeek, Suricata) or commercial NDR platforms (Vectra, Darktrace, ExtraHop, etc.).
• Proficiency in Linux command‑line operations.
• Basic scripting skills in Python or Bash for automation and log analysis.
• Knowledge of the MITRE ATT&CK framework, IDS/IPS, and firewall architecture.
• Understanding of NDR and SIEM operations.

Responsibilities

• Monitor and analyze dashboards and alerts from the NDR platform.
• Investigate network anomalies and security alerts.
• Conduct deep packet inspection for attack behaviors.
• Act as primary responder for network incidents.
• Support containment and remediation of incidents.
• Provide critical network forensics data.
• Adjust NDR detection rules for accuracy.
• Develop custom detection rules for emerging threats.

Skills

Network analysis tools (Wireshark, tcpdump)

TCP/IP protocols

Linux command-line operations

Scripting (Python, Bash)

MITRE ATT&CK framework

NDR and SIEM operations

Firewall architecture

Threat detection & analysis

Security investigations

Education

Bachelor’s degree in Information Technology or related field

Tools

Open-source tools (Zeek, Suricata)

Commercial NDR platforms (Vectra, Darktrace, ExtraHop)

Zeek

Suricata

Vectra / Darktrace / ExtraHop

Job description

SecurXcess technical defense team operates directly on customer sites, monitoring and responding to network threats to ensure resilient and secure infrastructures.

Requirements

• Bachelor’s degree in Information Technology or a related field.
• Based in Medan (onsite assignment).
• Minimum 1 year of experience as a Security Engineer or related role.
• Strong understanding of TCP/IP and common application protocols (DNS, HTTP/S, SMB, DHCP).
• Hands‑on experience with network analysis tools such as Wireshark or tcpdump.
• Familiarity with open-source tools (Zeek, Suricata) or commercial NDR platforms (Vectra, Darktrace, ExtraHop, etc.).
• Proficiency in Linux command‑line operations.
• Basic scripting skills in Python or Bash for automation and log analysis.
• Knowledge of the MITRE ATT&CK framework, IDS/IPS, and firewall architecture.
• Understanding of NDR and SIEM operations.

Job Description

• Monitor and analyze dashboards and alerts generated by the NDR platform in real time.
• Investigate network anomalies and security alerts to determine real incidents versus false positives.
• Conduct deep packet inspection (PCAP analysis) to identify attack behaviors such as lateral movement, C2 communication, or data exfiltration.
• Act as the primary technical responder for network‑based incidents and collaborate closely with SOC and IR teams.
• Support containment and remediation efforts by isolating affected systems and blocking malicious traffic.
• Provide critical network forensics data to support post‑incident investigations.
• Adjust and elevate NDR detection rules to reduce false positives and improve detection accuracy.
• Develop and elevate custom detection rules based on emerging threats, vulnerabilities (CVEs), and attacker TTPs.