Tier 2 SOC Analyst

Location: Woodmead Sandton
Job Type: Full-Time

We are hiring a proven technically strong Level 2 SOC Analyst who can operate independently under pressure take ownership of incidents and drive them to resolution without constant supervision.

You will be expected to lead investigations make defensible decisions and close security gaps proactively. If you require step-by-step guidance or lack real-world incident handling experience this role will not be a fit.

• Own incident response end-to-end: triage investigate contain eradicate and document without escalation unless absolutely necessary.
• Perform deep-dive forensic analysis across endpoints identities cloud and network layers.
• Correlate data across SIEM EDR IAM and network tools to identify advanced threats and attacker behaviour.
• Eliminate false positives through tuning and optimization not just escalating alerts.
• Conduct root cause analysis and produce clear technically sound reports with actionable remediation steps.
• Actively hunt for threats using hypothesis-driven and intelligence-led approaches.
• Develop maintain and enforce high-quality playbooks not generic documentation.
• Drive measurable improvements in detection capability and SOC efficiency.
• Mentor junior analysts but without compromising your own output or performance.
• Challenge weak controls and poor practices passively following process is not acceptable.
• Continuously tune and optimize SIEM rules and detection logic in collaboration with engineering teams.
• Operate effectively during high-pressure incidents including after-hours escalation when required.

• Minimum 5 years of hands-on SOC / incident response experience (not general IT support).
• Demonstrated experience handling real-world security incidents independently.

• SIEM (e.g. Sentinel Splunk)
• EDR/XDR (e.g. Microsoft Defender)
• IDS/IPS
• Threat intelligence platforms

• Windows and Linux internals
• Networking fundamentals (TCP/IP DNS HTTP/S etc.)
• Identity-based attacks and lateral movement techniques

• Logs memory artifacts process execution and authentication events

• Microsoft 365 Defender Intune Azure AD / Entra ID
• Working knowledge of MITRE ATT&CK framework and ability to map detections accordingly.
• Scripting/automation capability (PowerShell Python or KQL is expected not optional).

• You must be able to handle multiple incidents simultaneously without loss of quality.
• You must produce clear concise and technically accurate reports poor documentation will not be accepted.
• You are expected to reduce noise not contribute to it.
• You must demonstrate initiative ownership and accountability at all times.

• CySA CEH or equivalent

• AZ-104
• SC-200

• Azure security and cloud-native threats
• Detection engineering and SIEM rule creation
• DevOps environments

• NIST CIS ISO 27001

• Only theoretical knowledge without hands-on incident response experience
• Inability to explain past incidents you have handled in detail
• Reliance on escalation instead of investigation
• Weak understanding of logs attack techniques or detection logic

Submit your CV along with clear examples of incidents you have handled including:

• Tools used
• Investigation approach
• Outcome and remediation

Artificial Intelligence Innovation:

Join Netsurit at the forefront of AI transformationwhere technology meets ambition. Help us design implement and scale intelligent solutions that empower our clients to automate processes uncover insights and accelerate growth. Leverage tools like Microsoft Copilot Azure AI and custom machine learning models to turn data into meaningful business outcomes. Be part of a team thats shaping the future of AI-powered innovation.

Note to Agencies: Principals only. No recruiters no agencies no unsolicited services.