Job description for Cybersecurity Specialist at PT Mau Kerja Indonesia
About the Role
We are hiring a cybersecurity owner in Sleman, Yogyakarta. You will work closely with roughly 30–40 engineers plus Product, DevOps and stakeholders across Malaysia Vietnam. We ship quickly and our security structure is still developing. There is no mature SOC, detailed playbook, or large security team to hand you tasks. We need a strong security generalist with deeper strength in Application Security and Incident Response who can map what we have, decide what matters most, and build a lightweight security function that engineers actually use. This is one owner building the function - not one person expected to carry the depth of an entire security department.
What You Will Own
- Security visibility. Build and maintain a practical view of critical systems, assets, data flows, privileged access, vendors and major attack paths so we know what we are actually protecting.
- Application and release security. Review diffs, assess auth / session / API / access-control changes, validate vulnerabilities with evidence, and give a clear release call.
- Risk-based decisions under product pressure. Say BLOCK, FIX BEFORE RELEASE, SHIP WITH MITIGATION, ACCEPT TEMPORARY RISK, or MONITOR AND FIX LATER — and defend it technically without blocking everything.
- Incident investigation and containment. Detect, investigate logs, isolate endpoints, revoke / rotate credentials, block malicious traffic, verify containment and recovery, find root cause, and prevent recurrence.
- Working-stack operation. Use the SIEM, EDR, IAM / access control, and firewall / WAF we have; improve logging, coverage, and visibility where it is missing.
- Lightweight structure. Create only what gets used: release-security checklist, remediation tracking, incident-response flow, access-review baseline, asset / data inventory, audit evidence trail.
- Third-party and data risk. Ask what data a vendor / integration / SaaS / AI tool receives, what permissions it has, where data sits, and whether access can be revoked.
Requirements That Matter
PRIMARY DEPTH
- Application Security, secure SDLC, and vulnerability validation with manual retest.
- Incident investigation and containment: detection → investigation → containment → eradication → recovery → root cause → prevention. You have personally made containment decisions, not only escalated to L2/L3.
- Security risk assessment: what can hurt us, what blocks a release, what can ship with accepted risk, what is noise.
- 3+ years guideline in Security Engineer / Application or Product Security / Blue Team / SOC L2 with ownership / DevSecOps / Security Consultant who implemented fixes - or a pentester who moved into remediation and security engineering. Production evidence matters more than title or tenure.
- Comfortable working standalone in Sleman, Yogyakarta, onsite with ~30–40 engineers and remote stakeholders. You figure out next steps without waiting for a manager or mature SOP.
- Good fluency in English to work with stakeholders from Malaysia & Vietnam.
WORKING CAPABILITY
You can operate these well enough to investigate and contain. Depth in every tool is not required:
- SIEM, EDR, IAM / access control, firewall / WAF, cloud security fundamentals, data protection / DLP (for example Wazuh / Elastic / Splunk, CrowdStrike / SentinelOne, Palo Alto / Fortinet, cloud IAM).
- Scripting / automation (Python / Bash or similar), APIs, and CI/CD integrations to reduce repetitive manual work - useful, not mandatory.
What we are NOT looking for
- Report-only testers who hand over a PDF and consider the job done.
- Finders who never verify fixes or retest in staging and prod.
- Operators who escalate everything upward instead of deciding.
- Candidates who wait for mature SOPs before acting.
- Policy-only profiles uncomfortable with code, logs, and systems.
- Tool operators who cannot connect a finding to business risk.
- Candidates who treat every vulnerability as equally urgent and cannot prioritize by real business risk.
- Profiles that need a large security team around them to function.
