Threat Intelligence Engineer

About the role

Old Mutual is looking for a Threat Intelligence Engineer in Cape Town to provide technical security expertise and assurance across the Security Operations Centre (SOC) service, which is delivered by a third-party provider. The role ensures Old Mutual retains ownership, governance and accountability for SOC capabilities, and acts as a manager of self with oversight of the SOC service provider.

Key responsibilities

• Conduct technical assessments, technical verification and technical approvals of SOC tooling, architecture, detection engineering and incident handling, and identify technical gaps, risks and improvement opportunities.
• Provide hands-on technical support to Old Mutual's cloud infrastructure as an extension of the Cloud Security team, aligning SOC and cloud security controls.
• Build the threat intelligence framework protecting the network and support the SOC platform and services.
• Engage internal and external stakeholders, including the SOC service provider, and escalate material architectural changes, tooling replacements or significant risk acceptances to senior security and technology leadership.
• Maintain up-to-date expertise in SOC technologies, cloud security, threat detection engineering and incident response, and pursue continuous professional development.

Required profile

• Bachelor's degree in Information Security, Computer Science, Information Technology, Engineering or a related discipline (NQF Level 7).
• At least 5 years in cyber security, with at least 3 years in threat intelligence, SOC, threat detection engineering or incident response.
• Demonstrated experience supporting or overseeing MSSPs or outsourced SOC providers.
• Experience securing cloud platforms, preferably Microsoft Azure, including cloud-native security monitoring and incident investigation.

Required skills

• Enterprise security technologies: SIEM, EDR/XDR, threat intelligence platforms and security monitoring tools.
• Threat hunting, adversary tracking, IOCs and threat-led detection use cases.
• Cyber security frameworks such as NIST Cybersecurity Framework, MITRE ATT&CK, ISO 27001 and CIS Controls.
• Ability to communicate technical security risks to technical and non-technical audiences.