Security Operations Center Analyst L3

Protergo; Jakarta Pusat; On-site; IDR 400,000,000 - 580,000,000; Full time

Job summary

Protergo, Indonesia’s leading cyber-security company, seeks a Senior SOC Incident Response Lead to join our Jakarta team. You will manage advanced investigations, contain threats, and guide L1/L2 analysts in incident handling while coordinating with Compliance, Legal, and Management.

Responsibilities include forensic analysis, RCA reporting, and driving improvements in detection and response programs to strengthen the organization’s cyber resilience.

Qualifications

• Experience handling security incidents with depth in investigation and remediation.
• Ability to validate IoCs and attacker activity patterns.
• Strong understanding of incident response processes and post-incident reviews.

Responsibilities

• Handle incidents escalated from L2 with in-depth investigations of advanced threats.
• Ensure containment, eradication, and recovery activities are effective and timely.
• Validate IoCs, attack techniques, and attacker activity patterns.
• Conduct forensic analysis to collect and preserve digital evidence.
• Provide post-incident remediation recommendations and RCA findings.
• Oversee daily SOC operations and ensure alerts are properly investigated.
• Identify gaps and recommend improvements to SOC processes.

Skills

Incident response

Digital forensics

Threat hunting

SOC operations

Education

Bachelor's degree in CS or related field

Tools

SIEM

Job description

We are Indonesia’s leading cyber-security company, specializing in both Blue Team (Defense) and Red Team (Attack) services. Founded by an experienced team of cyber-security experts and fully incorporated in Indonesia, we have an in-depth understanding of the nation’s cyber-security landscape.

Job Description:

• Responsible for advanced security incident handling, including in-depth investigation, containment, eradication, and recovery of incidents escalated from L2.
• Conduct advanced threat analysis and forensic investigations, including identifying root causes and attack vectors in critical security incidents.
• Provide technical oversight of overall SOC operations and ensure that monitoring, investigation, and response processes are performed in accordance with established operational standards.
• Provide technical guidance, investigation validation, and strategic recommendations to L1 and L2 analysts in handling cybersecurity threats.
• Collaborate with internal and external stakeholders, including Compliance, Legal, and Management, in handling major security incidents and preparing forensic reports.
• Develop security improvement strategies, optimize threat detection capabilities, and continuously enhance SOC operational processes.

Responsibilities:

Incident Handling & Advanced Investigation

• Handle incidents escalated from L2 by conducting in-depth investigations of advanced security threats.
• Ensure containment, eradication, and recovery activities are performed effectively to minimize the impact of security incidents on business operations.
• Validate Indicators of Compromise (IoC), attack techniques, and attacker activity patterns.
• Conduct forensic analysis of compromised systems or endpoints to collect, preserve, and analyze digital evidence.
• Identify root causes, attack vectors, and incident timelines to support further investigation.
• Prepare forensic reports and provide post-incident remediation recommendations based on investigation findings.

Operational Oversight & Technical Supervision

• Provide technical oversight of daily SOC operations and ensure that all critical alerts are properly investigated and addressed.
• Review persistent alarms, analyst investigations, and the effectiveness of incident response processes.
• Identify operational gaps and recurring issues, and provide recommendations to improve SOC processes and operational efficiency.

Strategic Security Improvement

• Develop threat detection and mitigation strategies based on threat intelligence and findings from previous incident investigations.
• Provide recommendations for SIEM use case development, alert tuning, and enhancement of organizational security controls.
• Promote the implementation of security best practices to strengthen the organization's cyber resilience.
• Coordinate with internal stakeholders, management, and external teams in handling critical security incidents.
• Ensure that incident documentation, Root Cause Analysis (RCA), forensic findings, and technical reports are complete and accurate.
• Provide technical direction and feedback to L1 and L2 analysts to improve the quality of security investigations and incident response.