About the position
Introduction
Are you passionate about cybersecurity and enjoy investigating threats, responding to incidents, and strengthening security environments?
We are looking for an experienced Security Analyst to take ownership of the day-to-day monitoring, investigation, and resolution of cybersecurity threats and incidents across our environment.
In this role, you will work across security monitoring, incident response, vulnerability management, cloud security, identity and access security, application security, and compliance. You will also contribute to improving our overall security posture while providing technical guidance and support to junior analysts.
Description
Key Responsibilities
- Monitor, investigate, triage and resolve security alerts and incidents using SIEM, IDS/IPS, EDR and vulnerability management platforms.
- Investigate security incidents, determine root cause, scope and business impact, and lead containment, eradication and recovery activities.
- Perform vulnerability assessments, prioritise risks and drive vulnerabilities through to remediation and closure.
- Develop and tune SIEM detection rules, correlation logic and use cases while reducing false positives.
- Investigate phishing emails, suspicious files, malware and compromised user accounts or endpoints.
- Coordinate penetration testing and track security findings through to resolution.
- Conduct threat intelligence gathering and proactive threat hunting.
- Monitor user and privileged access and support MFA and least-privilege enforcement.
- Assess and harden AWS and Azure environments, including identity, storage, network controls, logging, keys and certificates.
- Support application security through static and dynamic security testing and secure code review.
- Support data protection, data classification and data loss prevention initiatives.
- Develop and maintain security policies, procedures and incident response playbooks.
- Support and lead security audits, risk assessments and compliance initiatives, including ISO 27001, POPIA and GDPR.
- Automate repetitive security tasks using scripting and orchestration.
- Produce security reports, metrics and dashboards for management and Group IT.
- Provide technical guidance and mentoring to junior security analysts.
Minimum Requirements
Minimum Requirements- Tertiary qualification in Information Security, Computer Science, Information Technology or a related field.
- Minimum 5 years' experience in cybersecurity operations, a SOC Analyst role or a comparable IT security position.
- CompTIA Security as a minimum baseline.
- CompTIA CySA or GIAC GCIH required or in progress at appointment.
- Hands-on experience resolving security incidents and vulnerabilities from detection through to remediation and closure.
- Experience with SIEM detection, alert investigation and security monitoring.
- Hands-on experience securing and monitoring AWS and/or Azure environments.
- Strong knowledge of vulnerability scanning, SIEM, network security and endpoint protection.
- Working knowledge of IAM, MFA and least-privilege principles.
- Knowledge of phishing analysis and email security controls.
- Understanding of digital forensics, evidence preservation and chain of custody.
- Knowledge of POPIA and GDPR security compromise notification requirements.
- Scripting experience using Python, PowerShell, Bash or similar.
Advantageous- SSCP or demonstrable progress towards CISSP.
- Cloud security certification, such as AWS Certified Security – Specialty or Microsoft SC-200.
- Experience with CrowdStrike or similar EDR platforms.
- Experience with application security testing, including SAST and DAST.
- Experience leading or supporting security audits, risk assessments and compliance initiatives.
What We Are Looking ForWe are looking for someone who is:
- Proactive, self-driven and accountable.
- Analytical and detail-oriented.
- Comfortable making decisions during live security incidents.
- Able to manage multiple incidents and priorities under pressure.
- Comfortable working independently while collaborating across teams.
- Able to influence and drive remediation without direct reporting authority.
- Strong in technical and report writing.
- Able to communicate technical risks clearly to non-technical stakeholders.
- Committed to continuous learning and development within cybersecurity.
Desired Skills:
- AWS
- Azure
- CompTIA CySA+
- GIAC GCIH
- Security monitoring
- PowerShell
- Bash
