Soc Technical Specialist — Intermediate

Location: Johannesburg, South Africa
Employment type: Full-time, permanent
Seniority: Intermediate to senior, two years or more in a SOC or technical security role

• Half analyst, half engineer. You investigate and hunt across client environments, and you also build and maintain the Elastic and Wazuh platforms that monitor them.
• Hands-on Elastic and Wazuh experience & Linux and Windows administration.
• Office-based with flexible hours, plus travel to client sites for installations and support.

Red Herd is a specialist cybersecurity recruitment and advisory firm. We work with consultancies, product companies, vendors and enterprise security teams across South Africa, the UK, Europe and the United States. We are recruiting this position exclusively on behalf of our client. We share their identity with you during qualification, before submitting anything. We never introduce your profile without your knowledge and consent.

Our client is an established cybersecurity consultancy that delivers offensive security and managed security services to organisations across Southern Africa and beyond. Its client base includes businesses in Portuguese- and French-speaking markets.

The SOC runs on Elastic and Wazuh, and the team deploys and supports those platforms inside client environments as well as monitoring through them.

This seat combines day-to-day SOC work with the engineering that makes the SOC possible. On one side, you monitor, investigate and hunt. On the other, you deploy agents, onboard log sources, tune detections and keep the platforms healthy across client installations.

It suits someone with solid SOC fundamentals who likes working with the technology as much as the alerts. You will work alongside consultants, infrastructure teams and client stakeholders to fix technical problems and widen security visibility.

What it is not. It is not a pure alert-monitoring seat, and it is not a back-office platform job either. You need to be comfortable doing both halves. It is not a people-management position.

• Monitor and triage security alerts, events and cases across client environments.
• Investigate suspicious activity using endpoint, network, identity, and application telemetry, and decide what is a real threat and what is a false positive.
• Escalate confirmed and high-risk incidents, and support initial analysis, evidence collection, scoping and containment under approved procedures.
• Run hypothesis-led threat hunts, mapping findings to MITRE ATT&CK.
• Deploy, configure and maintain Elastic- and Wazuh-based SOC installations, including Wazuh agents and Elastic data-collection components on Windows and Linux.
• Onboard log sources, then parse, normalise and validate them so the right telemetry actually arrives.
• Build and maintain dashboards, alerts, detection rules, decoders and integrations, and tune them to cut noise without hiding real threats.
• Watch platform health: ingestion, agent connectivity, storage, performance and data availability.
• Handle upgrades, configuration changes, backups and testing, and troubleshoot across applications, operating systems, networks, certificates, permissions and data pipelines.
• Support client installations remotely and on site.
• Write investigation notes, incident timelines, client-facing reports and system documentation, and help improve SOC playbooks and procedures.

At least two years in a SOC, security monitoring, security engineering or closely related technical security role. Treat that as a level, not a ceiling.

• Hands-on operational experience with both Elastic and Wazuh
  , in production, client or comparable lab environments.
• Working knowledge of the Elastic Stack:
  Elasticsearch, Kibana and ingestion through Elastic Agent, Beats or Logstash.
• Working knowledge of Wazuh: agent management, rules, decoders, alerting and troubleshooting.
• Real experience investigating alerts and security events in a SIEM or security analytics platform.
• Confident administration and troubleshooting on both Linux and Windows.
• A sound grasp of Windows event logs, Linux system and authentication logs, and endpoint telemetry.
• Networking fundamentals: TCP/IP, DNS, HTTP/S, firewalls, proxies and common network services.
• The ability to read raw logs and correlate events across sources.
• Clear written English for investigation notes and reports.
• Willingness and ability to travel for client installations and support.
• Legal eligibility to work in South…