Team lead SOC

SECURXCESS; Indonesia; On-site; IDR 1.006.542.000 - 1.342.057.000; Full time

Job summary

A leading cybersecurity firm in Indonesia is seeking an experienced L3 Engineer (SOC Team Leader) to lead incident response activities and conduct digital forensic investigations. The role requires at least 5 years of experience in a Security Operations Center, along with strong analytical skills and the ability to deliver concise technical reports. Candidates should hold a Bachelor's degree in a technical field and preferably have relevant cybersecurity certifications. This is an on-site position with mentoring opportunities for junior analysts.

Qualifications

• Strong experience in incident response, threat hunting, and detection engineering.
• Proven ability to lead under pressure and deliver clear reports.
• Strong analytical skills for contextual analysis across diverse security logs.

Responsibilities

• Lead end-to-end incident response activities.
• Perform advanced triage across environments.
• Conduct digital forensic investigations.

Skills

Incident response

Threat hunting

Detection engineering

Analytical skills

Technical leadership

Education

Bachelor’s degree in a technical field

Job description

L3 engineer (SOC Team Leader)

• Lead end-to-end incident response activities, from preparation through containment, eradication, recovery, and lessons learned.
• Perform advanced triage across host, network, and cloud environments.
• Lead, monitor, and conduct digital forensic investigations, including memory, disk, registry, Shimcache, Amcache, and browser artifacts.
• Perform quality control (QC) on analysis results and reports produced by security analysts.
• Review threat hunting outcomes and proactively communicate findings, including indicators of compromise (IOCs), behavioral patterns, TTP-based insights, and anomaly-driven detections.
• Design, fine-tune, and propose detection rules (e.g., YARA, Sigma, KQL, SPL, CrowdStrike RTR) aligned with the MITRE ATT&CK framework.
• Provide technical leadership and mentorship to L1/L2 analysts and support decision-making during incident war-room sessions.

Requirements

• Strong experience in incident response, threat hunting, and detection engineering.
• Proven ability to lead under pressure and deliver clear, concise technical and executive-level reports.
• Strong analytical skills with the ability to perform contextual analysis across diverse security logs (e.g., EDR, Sysmon, firewall, AWS/GCP/Azure audit logs).
• Strong threat intelligence and root‑cause analysis mindset.
• Bachelor’s degree (S1) in a technical field (e.g., Computer Science, Information Security, Engineering).
• Relevant cybersecurity certifications are preferred.
• Minimum of 5 years of experience working in a Security Operations Center (SOC).