SOC Analyst L3 – Threat Hunter / Detection Engineer / DFIR

Sagara Technology; Kota Bandung; On-site; IDR 240,000,000 - 420,000,000; Full time

Job summary

SAGARA Technology in Bandung is seeking an experienced SOC Analyst L3 to investigate advanced threats, hunt for APTs, and lead DFIR responses in a high-security environment. You will develop SIEM rules, leverage Google SecOps, and mentor junior analysts while shaping incident response strategies.

Fluent Bahasa Indonesia and English are preferred. This full-time position is based in Bandung, Indonesia, with opportunities to influence security posture across Southeast Asia.

Qualifications

• 4–5+ years in Blue Team, DFIR, or Red Team roles.
• Strong digital forensics tool and malware analysis knowledge.
• Deep understanding of cloud architectures (GCP, AWS, Azure).
• Knowledge of Active Directory internals and OS internals.
• Experience in SIEM detection engineering, preferably Google SecOps.
• Scripting and automation proficiency.
• Excellent communication skills in Bahasa Indonesia and English.
• Certifications such as GCFA, GNFA, GCTI, OSCP, CISSP, GCP/ AWS Security are preferred.

Responsibilities

• Conduct threat hunting to identify threats that evade automated detection.
• Lead responses to major security incidents and data breaches.
• Perform DFIR including memory forensics and malware analysis.
• Develop and optimize SIEM detection rules with YARA-L, Sigma, YARA, KQL, SPL.
• Leverage threat intelligence to improve detections.
• Design and implement SOAR automation for IR processes.
• Develop incident response strategies and procedures.
• Provide mentorship to SOC L1/L2 analysts.

Skills

Threat Hunting

Detection Engineering

DFIR

Threat Intelligence

Scripting & Automation

GCP

AWS

Azure

Active Directory internals

SIEM engineering

YARA-L

Sigma

YARA

KQL

SPL

APT Investigation

Education

GCFA

GNFA

GCTI

OSCP

CISSP

GCP Professional Cloud Security Engineer

AWS Certified Security – Specialty

Tools

YARA-L

Sigma

YARA

KQL

SPL

Google SecOps

Memory Forensics

Disk Imaging

Malware Analysis

SOAR

Job description

SOC Analyst L3 – Threat Hunter / Detection Engineer / DFIR

SAGARA Technology

Full-time Mid-Senior level

About the role

The SOC Analyst L3 serves as the highest technical escalation point within the Security Operations Center (SOC). This role is responsible for investigating sophisticated cyber threats, including Advanced Persistent Threats (APTs) and zero-day attacks that may bypass automated security detection. The position combines expertise in Threat Hunting, Detection Engineering, and Digital Forensics & Incident Response (DFIR), while providing technical leadership, mentoring, and strategic recommendations to improve the organization's overall security posture.

Responsibilities

• Conduct proactive, hypothesis-driven threat hunting to identify threats that evade automated detection.
• Investigate APT activities and lead responses to major security incidents and data breaches.
• Perform advanced Digital Forensics and Incident Response (DFIR), including memory forensics, disk imaging, malware analysis, and reverse engineering.
• Develop, implement, and optimize SIEM detection rules and use cases using YARA-L, Sigma, YARA, KQL, and SPL.
• Leverage threat intelligence to enhance detection capabilities and identify emerging cyber threats.
• Design and implement SOAR automation to streamline incident response processes.
• Develop and improve incident response strategies and procedures.
• Provide technical leadership, guidance, and mentorship to SOC L1 and L2 analysts.

Requirements

• Minimum 4–5+ years of experience in Blue Team, DFIR, or Red Team roles.
• Strong expertise in digital forensics tools and malware analysis.
• Deep understanding of cloud architectures, including GCP, AWS, and Azure.
• Strong knowledge of Active Directory internals and operating system internals.
• Extensive experience in SIEM detection engineering, preferably using Google SecOps.
• Proficiency in scripting and automation.
• Excellent communication skills, with the ability to present technical findings to both technical teams and management.
• Good command of both Bahasa Indonesia and English.
• Additional certifications such as GCFA, GNFA, GCTI, OSCP, CISSP, GCP Professional Cloud Security Engineer, or AWS Certified Security – Specialty are preferred.
• Experience in Threat Intelligence or Cybersecurity Research is also an advantage.

Skills

Google SecOps SIEM Detection Engineering YARA-L Digital Forensics & Incident Response (DFIR) Advanced Persistent Threat (APT) Investigation Google Cloud Platform (GCP) Amazon Web Services (AWS) Microsoft Azure Active Directory Internals

About SAGARA Technology

SAGARA Technology

Building digital products that move Indonesia forward.

SAGARA Technology is a digital product studio and software house delivering enterprise software, mobile apps, and AI-driven platforms for clients across Southeast Asia. We ship measurable outcomes with small, senior, cross-functional squads.