Job description for Cyber Defense Incident Responder (SOC) at PT Alto Network
Provide support to the incident response team in detecting, analyzing, and responding to cybersecurity incidents. Support 24/7 security monitoring and incident response operations through shift-based work arrangements (including day, night, weekend, and public holiday shifts). Work closely with senior incident response analysts to investigate security alerts, gather and preserve evidence, escalate incidents as required, and implement remediation actions to mitigate risks and protect the organization's information assets.
Qualifications
- Bachelor's degree in Computer Science, Information Security, Cybersecurity, or a related field
- Fresh graduates are welcome to apply
Job Description
- Assist in triaging security alerts and incidents to determine their severity, impact, and urgency, escalating critical incidents to senior analysts or incident response leads as needed.
- Communicate effectively with internal teams, stakeholders, and external partners to coordinate incident response efforts, share information, and provide updates on the status of security incidents.
- Provide timely and accurate incident updates in ticketing system based on SLA
- Conduct preliminary investigations into security incidents, gathering and analyzing data to identify signs of compromise, suspicious activity, or unauthorized access.
- Monitor security alerts generated by various security tools and systems, including SIEM, IDS/IPS, and endpoint detection platforms, to identify potential security incidents.
- Perform initial alert validation and categorization
- Provide support to senior incident response analysts during incident response activities, including containment, eradication, and recovery efforts, to minimize the impact of security incidents.
- Support the fulfillment of risk/findings audits relevant to the monitoring function.
- Participate in training/briefings provided to support good corporate governance within the respective area of work.
Requirements & Skills
Knowledge
- Basic network concepts: IP address, source/destination, port/protocol
- Basic cybersecurity concepts: malware, phishing, firewall, VPN, brute force, insider threat, and other common attack vectors
- Basic awareness of the incident response lifecycle, including alert severity and escalation criteria
Non-technical
- Problem-Solving
- Adaptability
- Time Management Skills
- Ability to work under pressure
- Attention to detail
- Time & shift discipline
- Basic critical thinking — able to connect information from alerts and communicate facts clearly and accurately (with evidence)
Technical
- Able to read basic information from Firewall, SIEM, EDR, WAF, IDS/IPS, or other security monitoring tool dashboards (at the level of understanding displayed status, not configuration)
- Able to recognize basic alert category/severity (informational vs. non-informational)
Point Plus:
- Prior experience as a SOC Analyst / SOC Monitoring / NOC
- Experience as an IDM/IAM/Security Engineer
- Experience working in a monitoring or operational shifting team
- Experience using SIEM, EDR, WAF, or other security monitoring tools
- Basic knowledge of scripting (PowerShell/Python)
