Cyber Security SOC Analyst

Location: Centurion, Gauteng (provisional – to be confirmed)
Positions Available: 5
Salary: Market-related
Employment Type: To be confirmed

We are seeking experienced and technically proficient Cyber Security Security Operations Centre (SOC) Analysts to monitor, detect, investigate and respond to cybersecurity threats across complex enterprise IT environments.

The successful candidates will be responsible for continuously monitoring security events, analysing suspicious activities, investigating security alerts and supporting the identification and containment of potential cybersecurity incidents.

This role requires strong hands‑on experience with Security Information and Event Management (SIEM) platforms, Endpoint Detection and Response (EDR) technologies, security event analysis, threat detection and incident investigation.

The ideal candidates will have proven experience working within an enterprise Security Operations Centre or equivalent cybersecurity monitoring environment, with the ability to identify genuine security threats, distinguish false positives from actionable incidents and escalate critical security events appropriately.

Candidates should demonstrate strong technical knowledge of enterprise networks, operating systems, security monitoring technologies and common cyberattack techniques.

Security Operations Centre Monitoring

• Monitor enterprise security systems, networks, endpoints, applications and cloud environments for potential cybersecurity threats.
• Analyse security alerts generated by SIEM, EDR, XDR, IDS/IPS, firewalls and other security monitoring technologies.
• Conduct continuous security event monitoring and identify suspicious or unauthorised activities.
• Investigate potential cybersecurity incidents and determine their severity, scope and business impact.
• Distinguish genuine security threats from false positives.
• Perform initial incident triage, classification and prioritisation.
• Escalate critical security incidents to incident response teams or senior cybersecurity specialists.
• Maintain accurate security monitoring records and incident investigation notes.
• Support continuous improvement of SOC monitoring processes and procedures.
• Work collaboratively with cybersecurity, infrastructure, networking and application teams.

Security Event Analysis and Investigation

• Investigate suspicious authentication attempts, unauthorised access and unusual network activity.
• Analyse system logs, endpoint telemetry, network traffic and cloud security events.
• Correlate security information from multiple monitoring platforms to identify potential threats.
• Investigate malware alerts, phishing incidents, suspicious processes and compromised accounts.
• Identify indicators of compromise and indicators of attack.
• Analyse suspicious activity involving privilege escalation, lateral movement and persistence techniques.
• Conduct preliminary investigations into potential data breaches and security policy violations.
• Document investigation findings and recommend appropriate remediation actions.
• Support incident responders with technical evidence and investigation findings.

Threat Detection and Security Analysis

• Monitor emerging cybersecurity threats, vulnerabilities and attacker techniques.
• Analyse threat intelligence and apply relevant indicators to security monitoring activities.
• Use the MITRE ATT&CK framework to understand and classify suspicious activity.
• Identify unusual patterns and anomalies within enterprise security logs.
• Support the development and refinement of SIEM detection rules and correlation searches.
• Identify gaps in security monitoring coverage and recommend improvements.
• Participate in threat hunting and proactive security investigations.
• Assist with…