L2 SOC Analyst – On‑site in Cape Town or Johannesburg

About the role

We are seeking a Level‑2 SOC Analyst to join our on‑site teams in Cape Town or Johannesburg. The role focuses on detecting, investigating and responding to security incidents for our clients, while also contributing to proactive threat‑hunting activities.

Key responsibilities

• Triaging security alerts, conducting thorough investigations, and communicating findings to clients.
• Performing threat‑hunting across client environments to uncover indicators of compromise and suspicious behaviour.
• Continuously reviewing and improving incident‑response procedures and detection rules.
• Assisting the Incident Response Team Leader in automating and streamlining response workflows.
• Documenting vulnerabilities, writing critical incident reports, and maintaining clear client communication throughout the incident lifecycle.

Required profile

• 2‑4 years of experience in a SOC, CSIRT or similar technical security role.
• Solid understanding of networking concepts and ability to analyse network‑related attacks.
• Familiarity with SIEM platforms such as Splunk, QRadar or Elastic Stack.
• Knowledge of the attack chain and experience with digital forensics and incident response is a plus.
• Bachelor’s degree in Computer Science, IT or related field and relevant certifications (e.g., Security+, PenTest+, Blue Team Level 1) are advantageous.

Required skills

• Splunk
• QRadar
• Elastic Stack
• Network traffic analysis
• Log investigation
• Digital forensics
• Incident response