SOC Analyst (Intermediate L2) – Cape Town

About the role

We are looking for an Intermediate (L2) SOC Analyst to join our growing Cyber Security Operations Centre in Century City, Cape Town. The role is hybrid, with 1–2 days a week on‑site, and operates within UK‑aligned core hours.

Key responsibilities

• Monitor, detect, triage and respond to security alerts across multiple client environments.
• Investigate incidents using SIEM tools, determine scope, urgency and impact.
• Own incidents through to resolution, documenting actions and reporting outcomes.
• Escalate complex threats and make L2‑level decisions.
• Conduct proactive threat‑hunting activities.
• Analyse logs and telemetry to identify anomalies and indicators of compromise.
• Collaborate with internal teams and external stakeholders to manage vulnerabilities and resolve incidents.

Required profile

• 2+ years experience as a SOC Analyst (L2) or L1 with exposure to L2 duties.
• Proven ability to investigate and respond to security incidents.
• Experience working in a SOC environment, preferably for a global organisation.

Required skills

• SIEM platforms: Microsoft Sentinel, IBM QRadar, Splunk.
• Endpoint and security tools: Microsoft Defender, CrowdStrike.
• Network analysis tools: Wireshark, TCPdump, Snort.
• Firewall, IPS/IDS and proxy logs: Palo Alto, Fortigate.
• Knowledge of intrusion analysis and threat investigation techniques.
• Relevant cybersecurity qualifications.

What we offer

• R450,000 per annum (incl. 20 days leave, medical aid, pension and shift allowance).
• Hybrid work set‑up (1–2 days in the Century City office).
• Opportunity to progress within a dynamic SOC team.