SOC Platform Engineer (Security Systems Architect)

PT Karya Solusi Prima Sejahtera; Jakarta Pusat; On-site; IDR 446,400,000 - 669,600,000; Full time

Job summary

PT Karya Solusi Prima Sejahtera is seeking a SOC Platform Engineer to own architecture, maintenance, and health of security platforms. You will design high-volume log pipelines and build API integrations to automate incident workflows.

The ideal candidate has 5–7 years in Infra/DevOps, with 3+ years in Splunk ES environments, and strong Linux/Windows, Python, and IaC skills. This role is based in Jakarta, with a focus on 24/7 platform availability.

Qualifications

• 5–7 years in Infrastructure/DevOps/Enterprise Admin roles.
• 3+ years designing, deploying, and managing large Splunk environments (ES).
• Proficient in Linux (RHEL/Ubuntu) and Windows Server.
• Programming/scripting for automation: Python, Bash, or Go; REST APIs.
• Strong IaC and DevOps experience with Terraform, Ansible, Docker, Kubernetes.
• Experience with Splunk ES optimization: DMA, CIM, license management (Cribl).
• Splunk certs (ES Architect/Consultant/Admin) are a plus; security certs valued.

Responsibilities

• Manage full lifecycle of SOC platform (SIEM, SOAR, EDR, TIP) including architecture and patching.
• Design and operate high-volume log pipelines across cloud, network, and endpoints.
• Create custom API integrations to connect security tools and automate incident playbooks.
• Optimize query performance and log storage; ensure 24/7 platform availability.
• Implement data model integrations aligned with CIM/RBA standards; DR and redundancy.

Skills

Splunk

Python

Bash

Go

REST API

Terraform

Ansible

Docker

Kubernetes

CIM

DMA

Cribl Stream

Splunk ES

Splunk Certified

Tools

Heavy Forwarder

ES Data Models

Job description

SOC Platform Engineer (Security Systems Architect)

Manage the full lifecycle of SOC platforms (SIEM, SOAR, EDR, TIP) including architecture, maintenance (patching), and health monitoring. Design and manage high-volume log data processing pipelines (cloud, network, endpoint) to ensure consistent parsing and formatting. Build custom API integration scripts to connect various security platforms and automate incident handling workflows (playbooks). Ensure efficient query performance, optimize log storage (retention/tiering), and implement data model integrations aligned with standards (CIM/RBA). Ensure 24/7 SOC platform operation by implementing backup strategies, disaster recovery, and redundancy management.

Key responsibilities

Manage full lifecycle of SOC platform (SIEM, SOAR, EDR, TIP) from architecture, maintenance (patching), to health monitoring

Design and manage high-volume log data processing pipelines (cloud, network, endpoint) for consistent parsing and formatting

Build custom API integration scripts to connect security platforms and automate incident handling workflows (playbooks)

Ensure efficient query performance and optimize log storage (retention/tiering)

Implement data model integrations aligned with standards (CIM/RBA)

Implement backup strategies, disaster recovery, and redundancy management for 24/7 platform operation

About you

Minimum 5–7 years of experience in Infrastructure Engineering, DevOps, Cloud Architecture, or Enterprise Systems Administration

Minimum 3+ years of specific experience designing, deploying, and managing large-scale Splunk environments (including Splunk Enterprise Security / ES)

Proven experience managing large-volume log data processing architecture (multi-terabyte per day)

Proficiency in Linux operating system administration (RHEL/Ubuntu) and Windows Server

Proficiency in programming/scripting languages for automation: Python, Bash, or Go, and REST API integration (JSON/XML)

Strong understanding of DevOps & Infrastructure as Code (IaC) using Terraform, Ansible, Docker, or Kubernetes

Experience in Splunk ES optimization: Data Model Acceleration (DMA), Common Information Model (CIM), and license savings/log filtering (e.g., Cribl Stream, Heavy Forwarder)

Splunk certifications (Splunk Enterprise Certified Architect, Splunk Core Certified Consultant, or Splunk Enterprise Security Certified Admin) – valued

Infrastructure/security certifications (CISSP, AWS Certified Solutions Architect, or Azure Solutions Architect) – valued

• Which of the following statements best describes your right to work in Indonesia?
• What's your expected monthly basic salary?
• How many years' experience do you have as a Security System Engineer?
• Which of the following types of qualifications do you have?
• How many years' experience do you have in a DevOps role?
• Do you have Linux Server Administration experience?