Senior Insider Threat Engineer: Detection, Hunt & Automation

PT Solusi Transportasi Indonesia; Jakarta Utara; On-site; IDR 400,000,000 - 700,000,000; Full time

Benefits offered by this job

Term Life Insurance

Medical Insurance

GrabFlex

Parental leave

Birthday leave

LASA volunteering leave

Grabber Assistance Programme

FlexWork hours

Job summary

Grab is seeking a senior insider threat security engineer to design and operate detection and investigation capabilities across identity, endpoints, cloud, and data platforms. You will translate complex threat scenarios into measurable signals, scalable detections, and preventive controls, reporting to the Lead of Insider Threat Detection.

This is an onsite role based in Jakarta. You will partner with Security Engineering, IAM, Data Governance, and Enterprise Security teams to close gaps in DLP,

Qualifications

• At least 5 years of experience in cybersecurity engineering, detection engineering, threat hunting, incident response, insider threat, or enterprise data protection.
• Proficiency in SQL and at least one programming or security-query language such as Python, KQL, or SPL.
• A solid understanding of identity, endpoint, cloud, SaaS, and enterprise data architectures, including common paths for credential, privilege, and data misuse.
• Practical experience investigating user activity across multiple telemetry sources and producing evidence-based findings.
• Familiarity with SIEM, UEBA, DLP, CASB, EDR/XDR, IAM, and cloud-security platforms.
• Hands-on experience building and tuning detections using large-scale security datasets, behavioural baselines, event correlation, anomaly detection, or risk scoring.
• Experience using AI tools and latest technologies to improve security workflows, with care when handling sensitive information.

Responsibilities

• Design, build and improve behavioural detections for data misuse, unusual access, excessive downloads, unauthorised data movement, credential misuse, privilege abuse, and attempts to bypass security controls.
• Lead complex technical investigations and proactive threat hunts, correlating identity, endpoint, network, cloud, SaaS, application, and data-access telemetry to reconstruct user activity and assess risk.
• Develop queries, scripts, data pipelines, risk-scoring models, and automation to improve telemetry enrichment, alert quality, case triage, investigation speed, and detection coverage.
• Partner with IAM, Endpoint Security, Data Governance, and Enterprise Security teams to identify and address gaps across DLP, CASB, SIEM, UEBA, EDR/XDR, cloud, and data-protection controls.
• Develop detection scenarios for Generative AI, large language models, AI agents, and Shadow AI, including sensitive-data exposure, misuse of enterprise AI capabilities, and AI-assisted attempts to evade security controls.

Skills

Threat hunting

Incident response

Security analytics

SQL

Python

KQL

SPL

IAM

SIEM

UEBA

Tools

DLP

CASB

EDR/XDR

IAM

Job description

Grab is seeking a senior insider threat security engineer to design and operate detection and investigation capabilities across identity, endpoints, cloud, and data platforms. You will translate complex threat scenarios into measurable signals, scalable detections, and preventive controls, reporting to the Lead of Insider Threat Detection.

This is an onsite role based in Jakarta. You will partner with Security Engineering, IAM, Data Governance, and Enterprise Security teams to close gaps in DLP,