Security Operations Center Analyst (L3)

Protergo; Jakarta Pusat; On-site; IDR 180,000,000 - 350,000,000; Full time

Job summary

Protergo, Indonesia’s leading cybersecurity company, is seeking a Senior Security Analyst to manage advanced incident handling and investigations escalated from L2. You will validate IoCs, perform forensic analysis, and coordinate remediation to minimize business impact.

You will provide technical oversight of daily SOC operations, tune detection capabilities, and deliver strategic improvements to security controls in collaboration with Compliance, Legal, and Management.

Qualifications

• Experience handling advanced security incidents.
• Proficient in forensic investigations and evidence handling.
• Ability to guide L1/L2 analysts and coordinate SOC operations.

Responsibilities

• Handle incidents escalated from L2 with in-depth investigations.
• Contain, eradicate, and recover from security incidents to minimize impact.
• Validate IoCs and attack techniques; perform digital forensics on compromised systems.
• Provide technical direction to L1/L2 analysts to improve incident response quality.
• Coordinate with Compliance, Legal, and Management during major incidents.

Skills

Incident handling

Forensic analysis

SOC oversight

Threat detection

Job description

We are Indonesia’s leading cyber-security company, specializing in both Blue Team (Defense) and Red Team (Attack) services. Founded by an experienced team of cyber-security experts and fully incorporated in Indonesia, we have an in-depth understanding of the nation’s cyber-security landscape.

Job Description:

• Responsible for advanced security incident handling, including in-depth investigation, containment, eradication, and recovery of incidents escalated from L2.
• Conduct advanced threat analysis and forensic investigations, including identifying root causes and attack vectors in critical security incidents.
• Provide technical oversight of overall SOC operations and ensure that monitoring, investigation, and response processes are performed in accordance with established operational standards.
• Provide technical guidance, investigation validation, and strategic recommendations to L1 and L2 analysts in handling cybersecurity threats.
• Collaborate with internal and external stakeholders, including Compliance, Legal, and Management, in handling major security incidents and preparing forensic reports.
• Develop security improvement strategies, optimize threat detection capabilities, and continuously enhance SOC operational processes.

Responsibilities:

Incident Handling & Advanced Investigation

• Handle incidents escalated from L2 by conducting in-depth investigations of advanced security threats.
• Ensure containment, eradication, and recovery activities are performed effectively to minimize the impact of security incidents on business operations.
• Validate Indicators of Compromise (IoC), attack techniques, and attacker activity patterns.
• Conduct forensic analysis of compromised systems or endpoints to collect, preserve, and analyze digital evidence.
• Identify root causes, attack vectors, and incident timelines to support further investigation.
• Prepare forensic reports and provide post-incident remediation recommendations based on investigation findings.

Operational Oversight & Technical Supervision

• Provide technical oversight of daily SOC operations and ensure that all critical alerts are properly investigated and addressed.
• Review persistent alarms, analyst investigations, and the effectiveness of incident response processes.
• Identify operational gaps and recurring issues, and provide recommendations to improve SOC processes and operational efficiency.

Strategic Security Improvement

• Develop threat detection and mitigation strategies based on threat intelligence and findings from previous incident investigations.
• Provide recommendations for SIEM use case development, alert tuning, and enhancement of organizational security controls.
• Promote the implementation of security best practices to strengthen the organization’s cyber resilience.
• Coordinate with internal stakeholders, management, and external teams in handling critical security incidents.
• Ensure that incident documentation, Root Cause Analysis (RCA), forensic findings, and technical reports are complete and accurate.
• Provide technical direction and feedback to L1 and L2 analysts to improve the quality of security investigations and incident response.