Cyber Security Operations Center (CSOC) Analyst, English Speaker

This is a fully remote position, open to applicants in Indonesia.

📋 Description

• Conduct triage, analysis, and escalation of security alerts across various sources including SIEM, EDR/XDR, WAF, email security, and cloud logs, collaborating with the MSSP as necessary.

• Manage incidents from initial triage through to resolution and document any changes made post-incident.

• Create, refine, and validate SIEM detection rules utilizing ES|QL, EQL, KQL, or similar languages.

• Transform threat intelligence feeds and scheduled hunting queries into actionable responses.

• Assist in establishing an insider threat monitoring program, focusing on identity and privileged-access anomaly detection.

• Ensure the proper onboarding and functionality of detection tools and log source pipelines.

• Monitor and report on CSOC performance metrics such as MTTD/MTTR, false-positive rates, and adherence to MSSP SLA.

• Draft and maintain operational documentation, playbooks, and rationales for detection rules.

• Aid in the automation of repetitive tasks related to triage and enrichment.

• Collaborate with internal teams and regional partners, where proficiency in the Chinese language may be beneficial.

⛳️ Requirements

• A Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related discipline.

• 3-4 years of experience in a Security Operations Center (SOC) or a comparable security monitoring/detection engineering position.

• Practical experience with SIEM tools, including the development of detection rules and use cases, validation of detections, alert triage, enrichment, case management using ticketing systems, and raw log analysis.

• Proficient in Python or similar scripting languages for automation, log parsing, or enhancing existing tools.

• Understanding of common attack techniques, malware behavior, and network security principles, with experience in mapping detections to the MITRE ATT&CK framework.

• Familiarity with incident response frameworks such as NIST and SANS, along with experience in creating playbooks or documentation based on real incidents.

• Experience in identity/IAM log analysis or insider threat/UEBA concepts is a significant advantage.

• Solid understanding of cloud security within AWS, Azure, or GCP environments.

• Comfortable working with Windows, Linux, and macOS platforms.

• Familiarity with Atomic Red Team or a similar adversary emulation framework is a plus.

• Proficiency in the Chinese language is a strong asset.

• Relevant certifications such as CISSP, GCIH, GCFA, CompTIA Security+, CySA+, or CEH are preferred.

🏝️ Benefits

• Competitive total compensation package

• Various team-building programs and company events