Senior Cybersecurity Engineer

The Senior Cybersecurity Engineer serves as a senior technical authority responsible for protecting the organization's information assets, systems, and digital infrastructure. Operating as a lead individual contributor within the Information Technology team, this role oversees core defensive security capabilities across endpoint, SIEM/SOC, identity, data loss prevention, web, and email security.

The position blends deep hands-on technical execution with operational risk governance,leading incident response workflows, driving vulnerability remediation, enforcing application and API security standards across development life cycles, translating threat intelligence into actionable defenses, and mentoring junior security personnel.

• Security Operations & Incident Response:

  Oversee enterprise SIEM/SOC operations, manage EDR/XDR deployments, and lead end-to-end incident handling (triage, containment, root-cause analysis, forensic investigation, and post-incident reporting).

• Identity, Access & Data Protection:

  Enforce identity governance, Multi-Factor Authentication (MFA), Single Sign-On (SSO), and Privileged Access Management (PAM). Configure and govern data security frameworks, information classification, and Data Loss Prevention (DLP) policies.

• Application, Web & API Security (Dev Sec Ops ):

  Establish and govern secure software development lifecycle (Secure SDLC) standards—including SAST, DAST, SCA, secrets management, and CI/CD security controls. Define and enforce API security architectures aligned to OWASP Top 10 standards (OAuth 2.0, OIDC, JWT, rate limiting, gateway policies). Manage Web Application Firewalls (WAF) to defend against DDoS, botnets, and application-layer threats.

• Cloud, Container & Infrastructure Defense:

  Monitor and secure cloud environments, containerized workloads, and Kubernetes clusters using CSPM/CNAPP tools and container scanning. Oversee network boundary controls, PKI/certificate lifecycle management, encryption standards, and email authentication mechanisms (SPF, DKIM, DMARC).

• Vulnerability Management & Threat Intelligence:

  Coordinate continuous vulnerability identification and remediation workflows, track penetration testing action items, analyze attacker TTPs, and operationalize external threat intelligence into active defensive postures.

• Governance, Risk & Compliance Support:

  Map technical controls and provide audit assurance against recognized industry frameworks and regulatory mandates (including ISO 27001, NIST CSF, CIS Controls, and POPIA).

• Leadership & Security Culture:

  Act as a subject-matter expert across cross-functional engineering teams, drive enterprise security awareness and simulated phishing campaigns, and mentor cybersecurity interns and junior analysts.

• Endpoint & Threat Hunting (EDR/XDR) Enterprise endpoint prevention, investigation, rapid containment, and host isolation.
• Monitoring & Operations (SIEM/SOC) Centralized logging, correlation rule development, alerting triage, and SOC oversight.
• Identity & Access Management (IAM) Principle of least privilege, Privileged Identity Management (PIM), identity life cycles, and access governance.
• Information Protection Classification labelling, Microsoft Purview / enterprise DLP, and sensitive asset protection.
• Application & API Security OWASP Top 10 / API Top 10, gateway architecture, code review oversight, CI/CD pipeline scanning, token-based authentication.
• Cloud & Container Security CSPM/CNAPP, infrastructure as code (IaC) verification, container image scanning, and Kubernetes security.
• Perimeter & Email Defense WAF rule configuration, anti-DDoS, mail filtering, business email compromise (BEC) investigation, SPF/DKIM/DMARC.
• Cryptography & PKI Certificate…