SOC Tier 1 Analyst & Tier 2 Incident Response

PT FPT Metrodata Indonesia; Jakarta Pusat; On-site; IDR 200,880,000 - 290,160,000; Full time

Job summary

PT FPT Metrodata Indonesia is seeking a SOC Tier 1 Analyst & Tier 2 Incident Response professional for an on-site role in Jakarta. The role involves real-time monitoring, analyzing, and responding to security incidents, including threat hunting and information gathering to support threat intelligence.

The candidate will work within a collaborative team to continually improve cybersecurity processes, produce detailed incident reports, and proactively identify vulnerabilities affecting client

Qualifications

• Minimum of 1 year of experience in SOC operations after obtaining a cybersecurity certification.
• Hold at least one cybersecurity certification such as CompTIA Security+, CompTIA CySA+, CSA, CEH, or BT Level 1.
• Identify, monitor, categorize, and investigate security events to detect early indicators or incidents across all sources.
• Work on a rotational shift basis and document all security alerts.

Responsibilities

• Perform initial investigations, assess incident urgency and severity, and escalate or close incidents per procedures.
• Provide concise shift handover reports highlighting critical alerts and ongoing incidents for the next shift.
• Conduct in-depth analysis of alerts classified as incidents to minimize false positives.
• Monitor SOC communications channels to track potential incidents reported by external teams.
• Ensure logs from all security devices are forwarded to the SIEM platform.

Skills

SOC operations

Incident response

Threat hunting

Communication & reporting

Education

Cybersecurity certification (e.g., CompTIA Security+, CEH, etc.)

Tools

SIEM

EDR/XDR tools

Job description

This is a full-time, on-site role based in Jakarta, Indonesia, for a SOC Tier 1 Analyst & Tier 2 Incident Response professional. The role involves real-time monitoring, analyzing, and responding to security incidents, as well as conducting cyber threat hunting and assisting in threat intelligence gathering. The analyst will work collaboratively to ensure the continuous improvement of cybersecurity processes and help minimize risks to clients' systems through detailed incident reporting and proactive identification of vulnerabilities.

Qualifications

• Minimum of 1 year of experience in Security Operations Center (SOC) operations after obtaining a relevant cybersecurity certification.
• Hold at least one of the following cybersecurity certifications: CompTIA Security+, CompTIA CySA+, CSA (Certified SOC Analyst), CEH, or Blue Team Level 1 (BTL1).
• Identify, monitor, categorize, and investigate security events promptly to detect early indicators or potential security incidents across all event and log sources.
• Work on a rotational shift basis and ensure all security alerts are properly documented and recorded.
• Perform initial investigations, assess incident urgency and severity, and **escalate or close incidents in accordance with established procedures**.
• Provide concise and relevant shift handover reports, highlighting critical alerts and ongoing incidents for the next shift.
• Conduct in-depth analysis of alerts classified as potential incidents and minimize false positive reports.
• Monitor SOC communication channels, including email and messaging platforms, to track potential incidents reported by external teams or other SOC stakeholders.
• Monitor log data availability and ensure that logs from all security devices are continuously and successfully forwarded to the SIEM platform.

SOC Incident Response & Investigations | Tier 2

• A minimum of 1 year of experience in SOC Tier 2 operations, obtained after acquiring a relevant cybersecurity certification.
• A minimum of 1 year of experience in the cybersecurity field, with relevant certifications such as ECIH, eCIR, or GCIH.
• Experienced in using SIEM and EDR/XDR tools.
• Manage event sources from internal (log infrastructure) and external (threat intelligence) sources; conduct investigations, analysis, and incident response (containment) for reported incidents; and communicate and collaborate.
• Serve as a Subject Matter Expert in detecting incidents and providing recommendations to the organization’s SOC.
• Conduct detailed incident analysis by correlating data from various sources.
• Determine whether a system is critical or collect data on systems impacted by the incident.
• Conduct threat hunting activities to identify potential security attacks.
• Conduct cybersecurity research and gather threat intelligence, dark web, and security forum information to support new analytical methods for threat detection.
• Assist in reviewing the effectiveness of SOC support tools and correlation rules on SOC support tools.