Threat Intelligence Engineer

About the role

Old Mutual is looking for a Threat Intelligence Engineer in Cape Town to provide technical security expertise and assurance across the Security Operations Centre (SOC) service, which is delivered by a third-party provider. The role ensures Old Mutual retains ownership, governance and accountability for SOC capabilities, and acts as a manager of self with oversight of the SOC service provider. It also gives hands-on technical support to Old Mutual's cloud infrastructure as an extension of the Cloud Security team.

Key responsibilities

• Conduct technical assessments, technical verification and technical approvals of SOC tooling, architecture, detection engineering and incident handling, and identify technical gaps, risks and improvement opportunities.
• Provide hands-on support to cloud infrastructure so that SOC and cloud security controls are aligned and fit for purpose.
• Build the threat intelligence framework protecting the network.
• Support the SOC platform and services, and maintain up-to-date expertise in SOC technologies, cloud security, threat detection engineering and incident response.
• Pursue continuous professional development through certifications, industry forums and threat intelligence awareness.
• Engage internal and external stakeholders and escalate material architectural changes, tooling replacements or significant risk acceptances to senior security and technology leadership.

Required profile

• Bachelor's degree in Information Security, Computer Science, Information Technology, Engineering or a related discipline (NQF Level 7).
• At least 5 years in cyber security, with at least 3 years in threat intelligence, SOC, threat detection engineering or incident response.
• Experience with enterprise security technologies such as SIEM, EDR/XDR, threat intelligence platforms and security monitoring tools.
• Experience developing and operating threat intelligence capabilities, including threat hunting, adversary tracking, IOCs and threat-led detection use cases.
• Demonstrated experience supporting or overseeing MSSPs or outsourced SOC providers.
• Hands-on experience securing cloud platforms, preferably Microsoft Azure, including cloud-native security monitoring and incident investigation.
• Understanding of frameworks such as NIST Cybersecurity Framework, MITRE ATT&CK, ISO 27001 and CIS Controls.
• Ability to explain technical security risks to technical and non-technical audiences.