Cyber Security SOC Engineer

Location: Gauteng

Positions Available: 5

Salary: Market-related

Employment type: 3 Year contract, hybrid

We are seeking experienced and technically proficient Cyber Security Security Operations Centre (SOC) Engineers to design, implement, configure, integrate, maintain and optimise enterprise security monitoring and threat detection technologies.

The successful candidates will be responsible for developing and maintaining the technical infrastructure that supports Security Operations Centre operations, including Security Information and Event Management (SIEM) platforms, Endpoint Detection and Response (EDR) solutions, security automation technologies and enterprise log management systems.

This role requires strong hands-on expertise in SOC engineering, SIEM administration, security monitoring architecture, detection engineering, log ingestion, security tool integration and cybersecurity automation.

The ideal candidates will have proven experience implementing and supporting enterprise security monitoring platforms, developing detection capabilities and ensuring that cybersecurity analysts have access to reliable, accurate and actionable security information.

Unlike a SOC Analyst, whose primary responsibility is investigating security alerts, a SOC Engineer focuses on building, configuring, maintaining and improving the security technologies and detection capabilities used by the SOC.

• Design, implement, configure and maintain enterprise SOC security monitoring infrastructure.
• Deploy and administer SIEM, EDR, XDR and related security monitoring technologies.
• Develop and maintain scalable security monitoring architectures.
• Configure security event collection, processing, correlation and retention.
• Integrate security monitoring solutions with enterprise infrastructure and cloud platforms.
• Ensure security monitoring technologies remain available, reliable and appropriately secured.
• Support SOC platform upgrades, migrations and infrastructure improvements.
• Implement security monitoring standards and operational procedures.
• Collaborate with SOC analysts, security architects and infrastructure teams to improve monitoring capabilities.
• Identify technical weaknesses in SOC infrastructure and recommend improvements.

• Install, configure, administer and optimise enterprise SIEM platforms.
• Integrate security logs from servers, endpoints, firewalls, network devices, applications and cloud services.
• Configure log collectors, agents, connectors and data ingestion pipelines.
• Develop and maintain SIEM correlation rules, detection logic and alerting mechanisms.
• Configure security dashboards, reporting and monitoring views.
• Optimise SIEM performance, data ingestion, storage and query efficiency.
• Troubleshoot log collection failures, parsing issues and integration problems.
• Monitor SIEM platform health and availability.
• Implement appropriate access controls and administrative security measures.
• Support SIEM upgrades, platform migrations and configuration management.

• Develop, implement and maintain cybersecurity detection rules and use cases.
• Translate threat intelligence and attacker techniques into actionable detection logic.
• Map security detection capabilities to the MITRE ATT&CK framework.
• Develop detection content for malware, ransomware, credential compromise, privilege escalation and lateral movement.
• Create and optimise SIEM queries and correlation searches.
• Validate detection rules using controlled testing and attack simulations.
• Reduce false positives and improve alert accuracy.
• Identify gaps in security telemetry and detection coverage.
• Collaborate with SOC analysts, threat…