Security Engineer - IT

As a Security Engineer, you will focus on the problem of keeping our systems safe and protecting our customers while adapting to the high-speed growth of our business and our enormous scale. You will be focusing on keeping interactions on our platform as simplified as possible using advanced engineering to detect and mitigate vulnerabilities and security flaws in Xtremax’s system. The ability to perform systems security or vulnerability analysis and design is a must. 

Responsibilities: 

• Develop a set of security standards and best practices for the organization and recommend security enhancements to management as needed. Develop strategies to respond to and recover from a security breach 
• Set up, configure, and tweak security in all infrastructure systems (System, Server, Network, and Client) 
• Handle, maintain and manage various potential security threats 
• Collaborate with other team members for security design and policy 
• Doing system hardening and penetration testing 
• Doing an internal security audit 
• Handle antivirus and malware protection 
• Doing backup and restore data in our system 
• Documented all internal audit processes, such as patching, update, server access log, VAPT, and backup recovery process 
• Conducts periodic scans of networks to find any vulnerability. They also conduct penetration testing, in which they simulate an attack on the system to highlight or find any weaknesses that might be exploited by a malicious party. 
• Proactive learning, assess and utilize new technologies and concepts with customer requirements 
• Responsibility for educating the workforce on information security through training and building awareness 

• Bachelor’s Degree in Software Engineering / Computer Science / Information Technology / equivalent or relevant work experience. 
• Having good knowledge about security systems and policy 
• Good at managing sensitive and confidential data, workstation devices, patching and upgrading systems, applications, services, and other infrastructure foundational components. 
• Good at planning, developing, and implementing IT security controls that are documented and working properly. 
• Familiar with system hardening and penetration testing 
• Experience handling antivirus and malware protection 
• Familiar with ISO27001 
• Familiar with Linux and Windows OS 
• Familiar with cloud security services such as AWS, Azure, and GCP 
• Able to create some script, i.e., bash, python 
• Love to learn, assess, and utilize new technologies 
• Having certification in cloud security area is a plus 

About the Role 

The Security Engineer plays a crucial role in Amartha. You will be the warrior who will spearhead various Information Security programs to protect Amartha from internal and external threats.

About the team

The Information Security team in Amartha is a group of dynamic, highly-analytical  individuals who are highly mindful in driving security and privacy by design within the various aspects of product lifecycle and engineering processes. We are the team who are highly passionate to be the security enabler of Amartha’s systems

Job Desc/What will you do

• Identify current and emerging technology issues including security trends, vulnerabilities and threats through various security assessment activities (including but not limited to: . penetration testing, vulnerability assessment, etc)
• Recognize complex technical issues and managing them within a fast-paced business environment
• Perform proactive investigation to analyze security weaknesses and recommend appropriate strategies
• Perform Threat intelligence activities
• Work closely with internal and external teams to implement security solutions
• Acquire and implement new technological solutions to enhance organizational security posture
• Identify, define and document system security requirements and recommend solutions
• Monitor systems for irregular behavior and set up preventive measures
• Manage bug bounty program
• Enhance the effectiveness of security related processes through automation and orchestration

Requirements

• 5+ years of related job experience
• Excellent analytical and interpersonal skills
• Ability to express technical information clearly at different organizational levels
• Having relevant certification are preferable (e.g.  CEH,OSCP, eCPPT, Ejpt etc)
• Advance knowledge in  API Security, Mobile/Application Security, Cloud Security
• Advance knowledge in security adversarial techniques, tactics, and procedures
• Experienced in conducting Static Application Security Test (SAST) and Dynamic Application Security Test (DAST)
• Experienced in scripting using Python, Bash, Go
• Highly skilled with strong hands-on experience with various security assessment tools such as Metasploit, BurpSuite, ZAP, OWASP tools, Hydra, Netsparker, Wireshark, Apktool, nikto, Cloudbrute , Kali Linux tools, Frida, MobSF, or comparable technologies
• Familiar with Cloud Platform such as GCP, AWS 
• Tools familiarity : Python, Bash, TerraFrom, Ansible, GitHub, Jenkins, Artifactory, Jira, Terraform, Git, BurpSuite, Hydra, Nessus, NMap, Metasploit, Frida, MobSF

About the Role 

The Senior Cloud Security Engineer plays a crucial role in Amartha. You will be the warrior who will spearhead various Information Security programs to protect Amartha from internal and external threats.

About the team

The Information Security team in Amartha is a group of dynamic, highly-analytical  individuals who are highly mindful in driving security and privacy by design within the various aspects of product lifecycle and engineering processes. We are the team who are highly passionate to be the security enabler of Amartha’s systems

Job Desc/What will you do

• Identify current and emerging technology issues including security trends, vulnerabilities and threats over the cloud-based infrastructure
• Recognize complex technical issues and managing them within a fast-paced business environment
• Perform proactive investigation to analyze security weaknesses and recommend appropriate strategies
• Perform Threat intelligence activities
• Work closely with internal and external teams to implement security solutions
• Acquire and implement new technological solutions to enhance organizational security posture
• Identify, define and document system security requirements and recommend solutions
• Monitor systems for irregular behavior and set up preventive measures
• Enhance the effectiveness of cloud security related processes through automation and orchestration

Requirements

• 5+ years of related job experience
• Excellent analytical and interpersonal skills
• Ability to express technical information clearly at different organizational levels
• Having relevant certification are preferable 
• Familiarity with Cloud Security concepts, principles, and technologies
• Familiar with Cloud Platform such as GCP, AWS 
• Experienced in scripting using Python, Bash scripting
• Familiar with a variety of DevSecOps toolkits, including Ansible, Jenkins, Artifactory, Jira, Terraform, Git/Version Control Software, or comparable technologies
• Familiar with a variety of Pentesting toolkits, including BurpSuite, Hydra, Nessus, NMap, Metasploit, Frida, MobSF, or comparable technologies
• Tools familiarity : Python, Bash, TerraFrom, Ansible, GitHub, Jenkins, Artifactory, Jira, Terraform, Git, Nessus, NMap, Metasploit

Deskripsi Pekerjaan - Building Manager

Tujuan Pekerjaan : 

Bertanggung jawab untuk mengelola dan memastikan operasional sehari-hari dari gedung atau fasilitas yang mereka tangani berjalan dengan efisien, aman, dan sesuai dengan standar yang ditetapkan. Juga memastikan kepatuhan terhadap peraturan dan kebijakan yang berlaku serta memastikan kenyamanan dan keamanan bagi penghuni atau pengguna gedung.

Tanggung Jawab Utama:

1. Mengelola semua aspek operasional sehari-hari gedung, termasuk keamanan, pemeliharaan / perawatan, kebersihan, dan fasilitas.
2. Menyusun dan melaksanakan jadwal rutin untuk perawatan gedung, termasuk sistem HVAC (Pemanas, Ventilasi, dan Pendingin Udara), peralatan listrik, sanitasi, dan perawatan lainnya.
3. Mengawasi dan mengkoordinasikan proyek-proyek perbaikan atau renovasi gedung.
4. Berkoordinasi dengan kontraktor, vendor, atau penyedia jasa lainnya untuk memastikan pekerjaan dilakukan sesuai dengan spesifikasi dan jadwal yang ditetapkan.
5. Mengelola tim staf gedung, termasuk perekrutan, pelatihan, evaluasi kinerja, dan pengembangan staf.
6. Menyusun jadwal kerja dan memastikan kehadiran yang konsisten.
7. Memastikan kepatuhan terhadap semua peraturan, dan kebijakan yang berlaku.
8. Menyelenggarakan inspeksi keselamatan dan memastikan prosedur evakuasi dan darurat diperbarui dan dipraktekkan secara teratur.
9. Menjaga hubungan yang baik dengan penghuni gedung atau pengguna fasilitas.
10. Menangani keluhan atau masalah operasional yang muncul dan mencari solusi yang memuaskan.

Kualifikasi:

• Pengalaman kerja dalam manajemen gedung atau fasilitas serupa di posisi yang sama min 5 tahun.
• Pengetahuan yang kuat tentang sistem teknis dan peraturan terkait manajemen gedung.
• Kemampuan komunikasi yang baik dan keterampilan kepemimpinan yang efektif.
• Kemampuan untuk bekerja secara mandiri serta dalam tim.
• Keahlian dalam manajemen waktu dan pengorganisasian yang baik.

Pendidikan:

S1 Teknik Sipil atau Teknik Elektro

Security Engineer – Governance 

We are looking for an experienced and knowledgeable IT Security Governance to join our Security Engineer team. You will be responsible for the management and advances of our security policies, standards, and procedures.  

Responsibilities:  

• Ensure the strategy and implementation of information security in accordance with the needs & applicable regulations  
• Develop an information security framework and architecture in accordance with the company's needs  
• Develop and maintain policies, standards, and procedures that support the information security framework in accordance with best practices and applicable regulations.  
• Actively identify, analyze, measure, provide control recommendations, and monitor follow-up on risk control & information security.  
• Carry out regular evaluations of the implementation of IT security management policies, standards, and procedures  

Requirements:  

• Bachelor’s Degree in Software Engineering / Computer Science / Information Technology / equivalent or relevant work experience.  
• Minimum 2 years experiences in IT industry  
• Familiar and able to implement and lead various best practices & regulations for IT Security & Cyber Security such as ISO 27000, CSA Star, CIS, NIST, GDPR, etc.  
• Familiar with Security compliance or assessment tools  
• Having experience implement ISO 27017 and 27018 is a plus point  
• Familiar with cloud environment is a plus point.  

About the Role 

The Security Engineer plays a crucial role in Amartha. You will be the warrior who will spearhead various Information Security programs to protect Amartha from internal and external threats.

About the team

The Information Security team in Amartha is a group of dynamic, highly-analytical  individuals who are highly mindful in driving security and privacy by design within the various aspects of product lifecycle and engineering processes. We are the team who are highly passionate to be the security enabler of Amartha’s systems

Job Desc/What will you do

• Identify current and emerging technology issues including security trends, vulnerabilities and threats
• Recognize complex technical issues and managing them within a fast-paced business environment
• Perform proactive investigation to analyze security weaknesses and recommend appropriate strategies
• Perform Threat intelligence activities
• Work closely with internal and external teams to implement security solutions
• Acquire and implement new technological solutions to enhance organizational security posture
• Identify, define and document system security requirements and recommend solutions
• Monitor systems for irregular behavior and set up preventive measures
• Manage bug bounty program
• Enhance the effectiveness of security related processes through automation and orchestration

• 5+ years of related job experience
• Excellent analytical and interpersonal skills
• Ability to express technical information clearly at different organizational levels
• Having relevant certification are preferable 
• Familiarity with API Security, Mobile/Application Security, Cloud Security
• Experienced in conducting Static Application Security Test (SAST) and Dynamic Application Security Test (DAST)
• Experienced in scripting using Python, Bash scripting
• Familiar with a variety of DevSecOps toolkits, including Ansible, Jenkins, Artifactory, Jira, Terraform, Git/Version Control Software, or comparable technologies
• Familiar with a variety of Pentesting toolkits, including BurpSuite, Hydra, Nessus, NMap, Metasploit, Frida, MobSF, or comparable technologies
• Familiar with Cloud Platform such as GCP, AWS 
• Tools familiarity : Python, Bash, TerraFrom, Ansible, GitHub, Jenkins, Artifactory, Jira, Terraform, Git, BurpSuite, Hydra, Nessus, NMap, Metasploit, Frida, MobSF

• Develop and oversee key performance indicators (KPIs) for security.
• Oversee service level agreements (SLAs) for security operations and create risk-based dashboards for reporting.
• Create and implement a comprehensive vulnerability management program, including managing activities related to vulnerability assessment (VA) and penetration testing (PT).
• Develop and implement security programs for network, server, and cloud environments, including onboarding processes and pre- and post-scanning activities.
• Conduct periodic configuration reviews based on CIS benchmarks.
• Manage the application security program by identifying and mitigating risks in collaboration with business application teams.
• Collaborate in managing the endpoint security, network security, and server security programs.
• Collaborate in managing the overall security operations management program.

• At least 3-5 years of documented work experience in security engineering.
• Prior practical knowledge of web, mobile, and cloud security.
• Hands-on experience in constructing and maintaining security measures such as firewalls, intrusion detection systems, antivirus software, authentication systems, content filtering, etc.
• Thorough understanding of IT infrastructure concepts across all layers, including Servers, Networks, End User Computing, and Cloud.
• Experience in designing and implementing risk-based information security programs.
• Hands-on experience in implementing standards such as ISO 27001, NIST, CIS, or equivalent.
• Hands-on experience in designing, implementing, and managing Data Leak Prevention programs.
• Hands-on experience in conducting application security assessments, both manual and tool-based.
• Gained solid understanding of OWASP, CIS, and NIST guidelines for application security.
• Experience in utilizing anti-malware solutions.
• Experience in designing security programs for cloud services, including IAAS, PAAS, and SAAS.
• Hands-on experience with native cloud security capabilities.
• Experience in implementing cloud security solutions like CASB.
• Excellent communication and presentation skills.
• Experience in collaborating with mid-level and senior-level management, with the ability to understand business processes and requirements.
• Understanding and effectively communicating security risks to core technology teams and business functions.
• Preferred certifications: CISSP, CCSP, CISM, ISO 270001 LI/LA.