L1 SOC Analyst Intern
- Compensation
- Not disclosed
- Location
- Banten
- Work setup
- Onsite
- Seniority
- Intern
- Employment
- Internship
- Experience
- Not specified
- Category
- Security
- Posted
Skills
Must have
- Final-year student or graduate within the last 12 months in Computer Science, Information Technology, Information Systems, Cybersecurity, or a related field.
- Working knowledge of TCP/IP, DNS, HTTP and HTTPS, and common service ports.
- Ability to read Windows Event Logs and Linux authentication and syslog entries.
- Understanding of common attack types: phishing, brute force, malware execution, command and control, and lateral movement.
- Awareness of the MITRE ATT&CK tactics and how an alert maps to them.
- Fluent Bahasa Indonesia and professional English. Tickets and handover notes are written in clear, short sentences.
- Availability for the full 6 months, onsite, on a rotating 24/7 shift roster.
Nice to have
- CompTIA Security+, CEH, ISC2 Certified in Cybersecurity, or Cisco CyberOps Associate.
- Hands-on SIEM exposure through coursework or a home lab, such as Wazuh, Elastic, or Splunk.
- Public lab or CTF activity on platforms such as TryHackMe or Hack The Box, with a profile link.
- Basic scripting in Python or PowerShell for log parsing.
- Familiarity with ISO 27001, NIST CSF, or PCI DSS control language.
Full description
L1 SOC Analyst Intern
6-month internship contract program
Role summary
Zentara is opening a 6-month L1 SOC Analyst internship program to add first-line capacity to its 24/7 Managed SOC. Interns take on business-as-usual alert handling on a defined schedule, under mentor review, and build toward independent shift work by month 4.
The work runs inside the SIEM. Each intern works the alert queue, applies written runbooks, records every decision in a ticket, and escalates to L2 through a fixed escalation path. A named L2 mentor reviews closed tickets throughout the program.
The result is more queue coverage for client environments, tighter adherence to response SLAs, and a pool of analysts already trained on Zentara's procedures.
About Zentara
Zentara Technologies is a cybersecurity and enterprise technology company headquartered in Indonesia, with a regional office in Singapore. It designs and delivers security for high-stakes institutions and mission-critical enterprises.
The company holds ISO 27001 and ISO 42001 certifications. Its team of 40+ professionals includes holders of certified professional personnels. The SOC itself is staffed by certified analysts and aligned to ISO 27001, PCI DSS, NIST CSF, and OJK requirements.
Responsibilities
- Monitor the SIEM alert queue and acknowledge each alert inside the response window for its severity.
- Triage alerts and classify each as true positive, false positive, or benign. Record the evidence behind every verdict.
- Enrich indicators such as IP addresses, domains, URLs, and file hashes using approved threat intelligence sources and SIEM context.
- Escalate confirmed and unresolved incidents to L2 through the defined escalation path. Each escalation carries a complete ticket.
- Analyze phishing emails reported by client users and return a documented verdict.
- Check log source health in SIEM and report sources that stop sending events.
- Keep each ticket current with a timeline, evidence, and actions taken.
- Write a handover note at every shift change so the incoming analyst starts with full context.
- Collect and verify data used in the monthly client reports, which run on an executive track and a technical track.
- Report runbook gaps and unclear detection logic to the SOC Lead with a proposed fix.
- Handle client data under Zentara's ISO 27001 information security policies.
Response SLAs the role works within
Zentara's SOC runs on tiered response SLAs: Critical alerts within 15 minutes, High within 1 hour, and Medium within 4 hours. L1 acknowledgment and triage are the first steps inside those windows.