SIEM & Elastic Security Engineer

Telkom Indonesia; Jakarta Pusat; On-site; IDR 279,000,000 - 502,200,000; Full time

Job summary

Telkom Indonesia is seeking an experienced cybersecurity engineer to maintain and optimize enterprise SIEM environments (Elastic Stack) in Jakarta. You will manage high-availability clusters, tune telemetry, and build detection rules and dashboards to strengthen security operations.

You will automate workflows, support incident response, and mentor junior engineers while collaborating with security teams to monitor threats, perform forensics, and advance threat intelligence programs.

Qualifications

• 3+ years of cybersecurity engineering experience in enterprise environments.
• Advanced knowledge of Elasticsearch, Logstash, Kibana, Fleet, and index management.
• Hands-on experience with Linux, Windows Server, cloud platforms, containers, storage and networking.
• Proficient in scripting with Python, PowerShell, and Bash.
• Strong understanding of security, incident response, and MITRE ATT&CK.
• Experience in log collection, parsing, normalization, detection engineering, threat monitoring, and security automation.
• Industry certifications such as Elastic Certified Engineer or Elastic Certified SIEM Analyst.

Responsibilities

• Maintain enterprise SIEM platforms and high-availability clusters.
• Normalize and optimize security telemetry using ECS, indexing strategies, and lifecycle management policies.
• Develop, tune, and maintain detection rules, and dashboards.
• Build automation workflows and scripts to enhance security operations.
• Support security analyst in alerts investigation, forensic analysis, and threat intelligence operationalization.
• Monitor and optimize SIEM performance and availability.
• Mentor junior engineers and promote security engineering best practice

Skills

Cybersecurity engineering

Threat monitoring

Security automation

Scripting (Python, PowerShell, Bash)

Incident response

MITRE ATT&CK

Linux administration

Windows Server administration

Team collaboration

Analytical thinking

Tools

Elasticsearch

Logstash

Kibana

Fleet

Index management

Shard allocation

Python

PowerShell

Bash

Job description

• Maintain enterprise SIEM platforms and high-availability clusters;
• Normalize and optimize security telemetry using ECS, indexing strategies, and lifecycle management policies.
• Develop, tune, and maintain detection rules, and dashboards;
• Build automation workflows and scripts to enhance security operations.
• Support security analyst in alerts investigation, forensic analysis, and threat intelligence operationalization.
• Monitor and optimize SIEM performance and availability.
• Mentor junior engineers and promote security engineering best practice

Qualification

• More than 3 years of cybersecurity engineering experience, including operating enterprise SIEM and large-scale Elastic Stack environments.
• Advanced knowledge of Elasticsearch, Logstash, Kibana, Fleet, index management, mappings, shard allocation, and security log analytics.
• Hands-on experience with Linux, Windows Server, cloud platforms, containers, and enterprise storage and networking technologies.
• Proficient in scripting with Python, PowerShell, and Bash.
• Strong understanding of security technologies, incident response, and the MITRE ATT&CK framework.
• Experience in log collection, parsing, normalization, detection engineering, threat monitoring, and security automation across enterprise environments.
• Analytical, adaptable, and collaborative.
• Proven industry certifications (Elastic Certified Engineer, Elastic Certified SIEM Analyst, or comparable)
• High level of integrity, professionalism, and ethical conduct in handling sensitive security information and systems.