SOC Analyst L-1 (Malang Based)

Nawatech; Klojen; On-site; IDR 200.000.000 - 300.000.000; Full time

Job summary

A cybersecurity firm in Indonesia is seeking a Security Operations Center (SOC) Analyst to monitor security events using various SIEM platforms. Responsibilities include analyzing security alerts, conducting investigations, and collaborating with teams to mitigate incidents. Ideal candidates will have 1-3 years of experience in cybersecurity, familiarity with SIEM platforms, and strong log analysis skills. This role offers rotational shifts and opportunities for skill development in a dynamic environment.

Qualifications

• 1-3 years of experience in cybersecurity or IT support.
• Familiarity with at least one SIEM platform.
• Basic understanding of TCP/IP and firewalls.
• Strong log analysis and incident troubleshooting skills.
• Foundational knowledge of OWASP Top 10.

Responsibilities

• Monitor security events using SIEM platforms.
• Analyze and triage security alerts.
• Conduct initial investigations of suspicious activities.
• Collaborate with security teams to mitigate incidents.
• Document investigation findings.

Skills

Monitoring security events

Log analysis

Incident troubleshooting

Basic threat hunting

Tools

Microsoft Sentinel

Splunk

Wazuh

Google SecOps

Sysmon

Suricata

Azure Monitor

Job description

What Will You Do

• Monitor security events and alerts using SIEM platforms such as Microsoft Sentinel, Splunk, Wazuh, or Google SecOps.
• Analyze and triage security alerts based on severity and potential impact.
• Conduct initial investigations of suspicious activities and potential security incidents.
• Collaborate with other security teams to escalate and mitigate incidents.
• Document investigation findings and assist in incident reporting.
• Support the development and maintenance of SOC playbooks and response procedures.
• Perform basic threat hunting based on Indicators of Compromise (IoCs).
• Assist in system patching and hardening based on security monitoring insights.
  
  

What Will You Need

• 1–3 years of experience in cybersecurity or IT support.
• Familiarity with at least one SIEM platform (Sentinel, Splunk, Wazuh, or Google SecOps).
• Basic understanding of TCP/IP, firewalls, IDS/IPS, and Windows/Linux systems.
• Strong log analysis and incident troubleshooting skills.
• Foundational knowledge of OWASP Top 10 and MITRE ATT&CK framework.
  
  

Nice to Have

• Certifications such as CompTIA Security+, SC-200, or CEH.
• Experience with tools like Sysmon, Suricata, or Azure Monitor.
• Basic scripting skills (Python, PowerShell, Bash).
• Exposure to cloud environments (Azure, AWS, GCP).
  
  

SOC Operational Focus

• Monitoring & Detection: Utilize SIEM to detect anomalies and potential attacks.
• Incident Response: Manage incidents from detection to resolution.
• Log Analysis: Analyze logs from firewalls, endpoints, servers, and applications.
• Threat Intelligence: Leverage threat intel feeds for contextual analysis.
• Reporting: Prepare daily and weekly security status reports.
  
  

Work Schedule

This role operates in two rotational shifts during working days:

• (Morning): 7:00 AM – 4:00 PM
• (Afternoon): 1:00 PM – 10:00 PM