Security Operations Center Analyst (L3)

Protergo; Jakarta Pusat; In loco; IDR 180.000.000 - 360.000.000; Tempo pieno

Descrizione del lavoro

Protergo in Jakarta is seeking a skilled security analyst to handle advanced incident response and investigations within our SOC. You will lead containment, eradication, and recovery for escalated incidents from L2, and provide forensic analyses and RCA findings.

You will oversee daily SOC operations, validate IoCs, and guide L1/L2 analysts. Collaboration with Compliance, Legal, and Management ensures thorough reporting and continuous improvement of detection capabilities.

Mansioni

• Handle incidents escalated from L2 by conducting in-depth investigations of advanced security threats.
• Ensure containment, eradication, and recovery activities are performed effectively to minimize the impact of security incidents on business operations.
• Validate Indicators of Compromise (IoC), attack techniques, and attacker activity patterns.
• Conduct forensic analysis of compromised systems or endpoints to collect, preserve, and analyze digital evidence.
• Identify root causes, attack vectors, and incident timelines to support further investigation.
• Prepare forensic reports and provide post-incident remediation recommendations based on investigation findings.
• Provide technical oversight of daily SOC operations and ensure that all critical alerts are properly investigated and addressed.
• Review persistent alarms, analyst investigations, and the effectiveness of incident response processes.
• Identify operational gaps and recurring issues, and provide recommendations to improve SOC processes and operational efficiency.
• Develop threat detection and mitigation strategies based on threat intelligence and findings from previous incident investigations.
• Provide recommendations for SIEM use case development, alert tuning, and enhancement of organizational security controls.
• Promote the implementation of security best practices to strengthen the organization's cyber resilience.
• Coordinate with internal stakeholders, management, and external teams in handling critical security incidents.
• Ensure that incident documentation, Root Cause Analysis (RCA), forensic findings, and technical reports are complete and accurate.
• Provide technical direction and feedback to L1 and L2 analysts to improve the quality of security investigations and incident response.

Descrizione del lavoro

We are Indonesia’s leading cyber-security company, specializing in both Blue Team (Defense) and Red Team (Attack) services. Founded by an experienced team of cyber-security experts and fully incorporated in Indonesia, we have an in-depth understanding of the nation’s cyber-security landscape.

Job Description:

• Responsible for advanced security incident handling, including in-depth investigation, containment, eradication, and recovery of incidents escalated from L2.
• Conduct advanced threat analysis and forensic investigations, including identifying root causes and attack vectors in critical security incidents.
• Provide technical oversight of overall SOC operations and ensure that monitoring, investigation, and response processes are performed in accordance with established operational standards.
• Provide technical guidance, investigation validation, and strategic recommendations to L1 and L2 analysts in handling cybersecurity threats.
• Collaborate with internal and external stakeholders, including Compliance, Legal, and Management, in handling major security incidents and preparing forensic reports.
• Develop security improvement strategies, optimize threat detection capabilities, and continuously enhance SOC operational processes.

Responsibilities:

Incident Handling & Advanced Investigation

• Handle incidents escalated from L2 by conducting in-depth investigations of advanced security threats.
• Ensure containment, eradication, and recovery activities are performed effectively to minimize the impact of security incidents on business operations.
• Validate Indicators of Compromise (IoC), attack techniques, and attacker activity patterns.
• Conduct forensic analysis of compromised systems or endpoints to collect, preserve, and analyze digital evidence.
• Identify root causes, attack vectors, and incident timelines to support further investigation.
• Prepare forensic reports and provide post-incident remediation recommendations based on investigation findings.

Operational Oversight & Technical Supervision

• Provide technical oversight of daily SOC operations and ensure that all critical alerts are properly investigated and addressed.
• Review persistent alarms, analyst investigations, and the effectiveness of incident response processes.
• Identify operational gaps and recurring issues, and provide recommendations to improve SOC processes and operational efficiency.

Strategic Security Improvement

• Develop threat detection and mitigation strategies based on threat intelligence and findings from previous incident investigations.
• Provide recommendations for SIEM use case development, alert tuning, and enhancement of organizational security controls.
• Promote the implementation of security best practices to strengthen the organization's cyber resilience.
• Coordinate with internal stakeholders, management, and external teams in handling critical security incidents.
• Ensure that incident documentation, Root Cause Analysis (RCA), forensic findings, and technical reports are complete and accurate.
• Provide technical direction and feedback to L1 and L2 analysts to improve the quality of security investigations and incident response.