Threat Hunter & Incident Response Engineer

PT Cemerlang Tunggal Intikarsa (CTI Group Jakarta); Jakarta Utara; On-site; IDR 400,000,000 - 700,000,000; Full time

Job summary

PT Cemerlang Tunggal Intikarsa (CTI Group Jakarta) is hiring a Threat Hunter & Incident Response Engineer to develop and maintain detection capabilities using Sigma, YARA, and related rules. You will lead DFIR investigations, containment, and root cause analysis across client environments.

You will monitor daily cyber threats and conduct PoC testing for new detections, while performing threat hunting and knowledge transfer to the SOC team in Jakarta.

Responsibilities

• Develop and maintain detection capabilities using Sigma, YARA, and other rules.
• Perform DFIR activities to support incident investigation, containment, and root cause analysis.
• Monitor and analyze daily cybersecurity threats, vulnerabilities, advisories, and new attack techniques.
• Conduct periodic SOC visibility and log completeness assessments to identify monitoring gaps.
• Perform IOC analysis and enrichment from logs, intel sources, and related data.
• Develop and enhance detection use cases and correlation rules for threat identification.
• Maintain documentation for detection capabilities, logic, use cases, and tuning.
• Conduct PoC testing, validation, and quality assessment of new detections before production.
• Threat hunting activities to proactively identify suspicious activities and indicators of compromise.
• Provide knowledge transfer and guidance to SOC Analysts to boost capabilities.
• Collaborate with SOC and Security Engineering to improve detection coverage and visibility.

Job description

Threat Hunter & Incident Response Engineer

• Develop and maintain detection capabilities using technologies and frameworks such as Sigma, YARA, and other detection rules.
• Perform Digital Forensics and Incident Response (DFIR) activities to support security incident investigation, containment, and root cause analysis.
• Monitor and analyze daily cybersecurity threats, vulnerabilities, security advisories, and emerging attack techniques relevant to the organization and its customers.
• Conduct periodic SOC visibility and log completeness assessments to identify gaps in security monitoring and detection coverage.
• Perform IOC analysis and enrichment based on integrated security logs, threat intelligence sources, and other relevant data.
• Develop and enhance detection use cases and correlation rules to identify potential security threats based on IOCs, TTPs, and observed attack patterns.
• Maintain comprehensive documentation for detection capabilities, including detection logic, use cases, rule development, validation, and tuning.
• Conduct Proof of Concept (PoC), testing, validation, and quality assessment of new detection capabilities before production implementation.
• Perform threat hunting activities to proactively identify suspicious activities, advanced threats, and potential indicators of compromise within monitored environments.
• Provide knowledge transfer and technical guidance to SOC Analysts across L1–L3 to improve investigation, detection, and incident response capabilities.
• Collaborate with SOC, Security Engineering, and other technical teams to continuously improve detection coverage, monitoring visibility, and overall SOC capabilities.