L1 SOC Analyst Intern
L1 SOC Analyst Intern
6-month internship contract program
Role summary
Zentara is opening a 6-month L1 SOC Analyst internship program to add first-line capacity to its 24/7 Managed SOC. Interns take on business-as-usual alert handling on a defined schedule, under mentor review, and build toward independent shift work by month 4.
The work runs inside the SIEM. Each intern works the alert queue, applies written runbooks, records every decision in a ticket, and escalates to L2 through a fixed escalation path. A named L2 mentor reviews closed tickets throughout the program.
The result is more queue coverage for client environments, tighter adherence to response SLAs, and a pool of analysts already trained on Zentara's procedures.
About Zentara
Zentara Technologies is a cybersecurity and enterprise technology company headquartered in Indonesia, with a regional office in Singapore. It designs and delivers security for high-stakes institutions and mission-critical enterprises.
The company holds ISO 27001 and ISO 42001 certifications. Its team of 40+ professionals includes holders of certified professional personnels. The SOC itself is staffed by certified analysts and aligned to ISO 27001, PCI DSS, NIST CSF, and OJK requirements.
Responsibilities
Monitor the SIEM alert queue and acknowledge each alert inside the response window for its severity.
Triage alerts and classify each as true positive, false positive, or benign. Record the evidence behind every verdict.
Enrich indicators such as IP addresses, domains, URLs, and file hashes using approved threat intelligence sources and SIEM context.
Escalate confirmed and unresolved incidents to L2 through the defined escalation path. Each escalation carries a complete ticket.
Analyze phishing emails reported by client users and return a documented verdict.
Check log source health in SIEM and report sources that stop sending events.
Keep each ticket current with a timeline, evidence, and actions taken.
Write a handover note at every shift change so the incoming analyst starts with full context.
Collect and verify data used in the monthly client reports, which run on an executive track and a technical track.
Report runbook gaps and unclear detection logic to the SOC Lead with a proposed fix.
Handle client data under Zentara's ISO 27001 information security policies.
Response SLAs the role works within
Zentara's SOC runs on tiered response SLAs: Critical alerts within 15 minutes, High within 1 hour, and Medium within 4 hours. L1 acknowledgment and triage are the first steps inside those windows.
Required qualifications
Final-year student or graduate within the last 12 months in Computer Science, Information Technology, Information Systems, Cybersecurity, or a related field.
Working knowledge of TCP/IP, DNS, HTTP and HTTPS, and common service ports.
Ability to read Windows Event Logs and Linux authentication and syslog entries.
Understanding of common attack types: phishing, brute force, malware execution, command and control, and lateral movement.
Awareness of the MITRE ATT&CK tactics and how an alert maps to them.
Fluent Bahasa Indonesia and professional English. Tickets and handover notes are written in clear, short sentences.
Availability for the full 6 months, onsite, on a rotating 24/7 shift roster.
Preferred qualifications
CompTIA Security+, CEH, ISC2 Certified in Cybersecurity, or Cisco CyberOps Associate.
Hands-on SIEM exposure through coursework or a home lab, such as Wazuh, Elastic, or Splunk.
Public lab or CTF activity on platforms such as TryHackMe or Hack The Box, with a profile link.
Basic scripting in Python or PowerShell for log parsing.
Familiarity with ISO 27001, NIST CSF, or PCI DSS control language.
Competencies assessed
Analytical rigor: every verdict traces to evidence in the ticket.
Written precision: another analyst can act on a ticket with minimum supervision.
Composure under queue pressure: the analyst keeps to the runbook when alert volume rises.
Accountability at handover: open items are named, owned, and dated.
Response to review: feedback from the mentor shows up in the next week's tickets.
Exit measures
Performance is measured on sampled tickets and shift records. Targets apply from the Independent L1 phase onward.
Acknowledgment within SLA: Alerts acknowledged inside the window for their severity (Target: 95% or higher)
Triage accuracy: Verdicts that match the L2 review of the same alert (Target: 90% or higher)
Escalation quality: Escalations accepted by L2 without a return for missing information (Target: 90% or higher)
Ticket completeness: Sampled tickets with timeline, evidence, and actions filled in (Target: 100%)
Handover compliance: Shifts closed with a written handover note (Target: 100%)
Targets are proposed and are confirmed by the SOC Lead before the program starts.
Engagement terms
Contract: Fixed-term internship contract for 6 months. The contract ends on the final day of month 6 unless a separate offer is issued.
Shift pattern: 3 Shifts including Morning, Afternoon, Night (10 hours each). The roster is published before each month starts.
Mentoring: One assigned L2 mentor. Weekly review session with the mentor. Monthly progress review with the SOC Lead.
Conversion: The month 5 review and the exit review inform eligibility for further decision from management
Conditions of engagement: Signed NDA, background and reference check, and acceptance of Zentara's ISO 27001 information security policies before system access is granted.