Cyber Security SOC Analyst

Location: Centurion, Gauteng (provisional – to be confirmed)

Positions Available: 5

Salary: Market-related

Employment Type: To be confirmed

Job Overview We are seeking experienced and technically proficient Cyber Security Security Operations Centre (SOC) Analysts to monitor, detect, investigate and respond to cybersecurity threats across complex enterprise IT environments.

The successful candidates will be responsible for continuously monitoring security events, analysing suspicious activities, investigating security alerts and supporting the identification and containment of potential cybersecurity incidents.

This role requires strong hands-on experience with Security Information and Event Management (SIEM) platforms, Endpoint Detection and Response (EDR) technologies, security event analysis, threat detection and incident investigation.

The ideal candidates will have proven experience working within an enterprise Security Operations Centre or equivalent cybersecurity monitoring environment, with the ability to identify genuine security threats, distinguish false positives from actionable incidents and escalate critical security events appropriately.

Candidates should demonstrate strong technical knowledge of enterprise networks, operating systems, security monitoring technologies and common cyberattack techniques.

Key Responsibilities

Security Operations Centre Monitoring

• Monitor enterprise security systems, networks, endpoints, applications and cloud environments for potential cybersecurity threats.
• Analyse security alerts generated by SIEM, EDR, XDR, IDS/IPS, firewalls and other security monitoring technologies.
• Conduct continuous security event monitoring and identify suspicious or unauthorised activities.
• Investigate potential cybersecurity incidents and determine their severity, scope and business impact.
• Distinguish genuine security threats from false positives.
• Perform initial incident triage, classification and prioritisation.
• Escalate critical security incidents to incident response teams or senior cybersecurity specialists.
• Maintain accurate security monitoring records and incident investigation notes.
• Support continuous improvement of SOC monitoring processes and procedures.
• Work collaboratively with cybersecurity, infrastructure, networking and application teams.

Security Event Analysis and Investigation

• Investigate suspicious authentication attempts, unauthorised access and unusual network activity.
• Analyse system logs, endpoint telemetry, network traffic and cloud security events.
• Correlate security information from multiple monitoring platforms to identify potential threats.
• Investigate malware alerts, phishing incidents, suspicious processes and compromised accounts.
• Identify indicators of compromise and indicators of attack.
• Analyse suspicious activity involving privilege escalation, lateral movement and persistence techniques.
• Conduct preliminary investigations into potential data breaches and security policy violations.
• Document investigation findings and recommend appropriate remediation actions.
• Support incident responders with technical evidence and investigation findings.

Threat Detection and Security Analysis

• Monitor emerging cybersecurity threats, vulnerabilities and attacker techniques.
• Analyse threat intelligence and apply relevant indicators to security monitoring activities.
• Use the MITRE ATT&CK framework to understand and classify suspicious activity.
• Identify unusual patterns and anomalies within enterprise security logs.
• Support the development and refinement of SIEM detection rules and correlation searches.
• Identify gaps in security monitoring coverage and recommend improvements.
• Participate in threat hunting and proactive security investigations.
• Assist with identifying potential security control weaknesses.
• Support detection validation and continuous security monitoring improvements.

Incident Response and Escalation

• Perform initial response activities for suspected cybersecurity incidents.
• Follow established incident response playbooks and escalation procedures.
• Assess security incident severity and potential organisational impact.
• Support containment activities in collaboration with authorised technical teams.
• Escalate complex incidents requiring advanced investigation or forensic analysis.
• Maintain incident timelines and investigation records.
• Support incident response teams during major cybersecurity events.
• Participate in post-incident reviews and lessons-learned activities.
• Recommend improvements to incident detection and escalation procedures.

SIEM, EDR and Security Technology Operations

• Operate and monitor enterprise SIEM platforms.
• Investigate endpoint security alerts using EDR and XDR technologies.
• Analyse firewall, proxy, DNS, authentication and network security logs.
• Monitor security events across Windows, Linux and cloud environments.
• Support SIEM use-case development and alert tuning.
• Assist with security log source integration and monitoring coverage.
• Identify and report monitoring tool failures or gaps in security telemetry.
• Maintain SOC dashboards, investigation records and operational reports.
• Support security automation and incident response workflow improvements.

SOC Reporting and Documentation

• Maintain accurate records of security alerts, investigations and escalated incidents.
• Prepare security incident summaries and technical investigation reports.
• Produce SOC operational reports and security monitoring statistics.
• Document recurring threats, suspicious activities and security trends.
• Maintain SOC procedures, investigation guides and operational documentation.
• Support cybersecurity audits and security compliance activities.
• Provide recommendations to improve threat detection and SOC effectiveness.
• Participate in SOC knowledge-sharing and technical development initiatives.

Minimum Requirements

• Relevant diploma or degree in Information Technology, Computer Science, Cybersecurity, Information Security, Network Engineering or a related discipline.
• Typically 3–5 years of relevant hands-on experience in cybersecurity monitoring, SOC operations, security event analysis or incident investigation.
• Proven practical experience working within an enterprise Security Operations Centre or equivalent security monitoring environment.
• Strong hands-on experience with at least one enterprise SIEM platform.
• Practical experience investigating security alerts and analysing security events.
• Familiarity with EDR, XDR, firewall and network security monitoring technologies.
• Strong understanding of cybersecurity threats, attack techniques and indicators of compromise.
• Experience conducting security incident triage, classification and escalation.
• Knowledge of Windows and Linux operating systems.
• Understanding of Microsoft Active Directory, authentication systems and identity-related security threats.
• Good understanding of TCP/IP networking, DNS, HTTP/HTTPS and common network protocols.
• Familiarity with the MITRE ATT&CK framework.
• Experience analysing security logs and correlating information from multiple sources.
• Understanding of incident response procedures and cybersecurity investigation principles.
• Familiarity with cloud security monitoring environments would be advantageous.
• Strong analytical, technical troubleshooting and documentation skills.

Technical Skills and Competencies

Security Operations Centre Operations

• SOC monitoring and operations
• Security alert investigation
• Security event triage
• Incident severity classification
• Threat detection
• Incident escalation
• Security monitoring procedures
• SOC dashboards and reporting
• Security incident documentation
• SOC operat