SOC Analyst – Tier 2 Security Operations

About the role

We are looking for a mid‑level SOC Analyst (Tier 2) to join our Security Operations team in Cape Town. You will go beyond basic alert triage, leading advanced investigations, threat hunting and tool optimisation to strengthen Zappi’s security posture.

Key responsibilities

• Investigate and respond to security incidents across endpoints, networks and cloud environments.
• Lead proactive threat‑hunting campaigns to uncover malicious activity beyond automated alerts.
• Refine and tune SIEM, IDS/IPS and EDR detections to reduce false positives.
• Analyse logs and network traffic to identify attack patterns and techniques.
• Support vulnerability management by collaborating with Engineering on risk prioritisation and remediation.
• Research emerging threats and integrate threat intelligence into defensive controls.
• Contribute to runbooks, playbooks and process improvements backed by data‑driven evidence.
• Generate actionable reports and insights to improve detection and prevention.

Required profile

• Minimum 2 years of experience working in a SOC or similar IT security operations environment.
• Hands‑on experience with SIEM/IDS platforms (e.g., Wazuh) for log analysis, detection and rule tuning.
• Familiarity with endpoint detection and response tools (e.g., SentinelOne) and network traffic analysis.
• Basic scripting ability (Python, Bash or PowerShell) to automate investigations.
• Experience supporting vulnerability management processes.

Required skills

• Wazuh (or comparable SIEM/IDS)
• SentinelOne (or comparable EDR)
• Python scripting
• Bash scripting
• PowerShell scripting
• SIEM tuning and rule creation
• IDS/IPS configuration
• Vulnerability management
• Log analysis
• Network traffic analysis
• Threat hunting techniques

What we offer

• Competitive salary range R550,000 – R650,000 per year.
• Opportunity to shape a growing SOC at an inflection point.
• Supportive environment with high standards and continuous learning.