Cyber Defense Architect & Incident Response Lead

Border Management Authority; South Africa; Hybrid; ZAR 600,000 - 900,000; Full time

Benefits offered by this job

Competitive salary

Medical aid

Retirement fund

Training & certifications

Generous leave

Hybrid work in Soweto

Job summary

Border Management Authority in Soweto, Gauteng, is seeking an Information Security Analyst with a specialization in Incident Response to join our security operations team. You will monitor alerts, analyze incidents, and contain threats to protect sensitive data and systems in a hybrid work environment.

The ideal candidate has a bachelor’s degree in a related field and at least three years of information security experience focused on incident response, with hands-on SIEM/EDR and forensic

Qualifications

• Bachelor's degree in Computer Science, Cybersecurity, IT, or related field, or equivalent practical experience.
• Minimum 3 years in information security with a focus on incident response or security operations.
• Hands-on experience with SIEM, EDR, network analysis tools, and forensic tools.
• Understanding of attack vectors, malware, and threat actor methodologies.
• Proficiency in analyzing system logs, network traffic, and endpoint data.
• Knowledge of incident response frameworks and best practices.
• Scripting skills (Python) for automation are a plus.
• Strong analytical and problem-solving abilities with attention to detail.
• Excellent communication and interpersonal skills; ability to work under pressure.
• Certifications such as CompTIA Security+, CEH, or GCIH are advantageous.
• Hybrid work capability in Soweto, Gauteng.

Responsibilities

• Monitor security alerts and events from SIEM, IDS/IPS, EDR to identify incidents.
• Investigate and analyze incidents: scope, impact, root cause.
• Contain, eradicate, and recover compromised systems and data.
• Conduct forensic analysis of security breaches, including malware analysis and log examination.
• Develop and maintain incident response playbooks and procedures.
• Collaborate with IT, Legal, Communications and external stakeholders during incident response.
• Contribute to threat intelligence gathering and analysis to enhance detection.
• Participate in post-incident reviews to identify lessons learned and improvements.
• Stay up-to-date with the latest threats, vulnerabilities, and techniques.
• Assist in vulnerability management activities and remediation.

Skills

SIEM

EDR

Network analysis

Forensic tools

Python scripting

Incident response

Education

Bachelor's degree or equivalent

Tools

SIEM tools

EDR tools

Forensic tools

Job description

Information Security Analyst - Incident Response Specialist

Our client is seeking a dedicated and skilled Information Security Analyst with a specialization in Incident Response to join their security operations team. This role is pivotal in protecting the organization from cyber threats by promptly detecting, analyzing, and responding to security incidents. You will be at the forefront of safeguarding sensitive data and systems, working with advanced tools and methodologies to contain threats and minimize impact. This is an excellent opportunity for a proactive security professional to grow their career within a dynamic environment in Soweto, Gauteng, with a hybrid work arrangement.

About the Role

Our client is seeking a dedicated and skilled Information Security Analyst with a specialization in Incident Response to join their security operations team. This role is pivotal in protecting the organization from cyber threats by promptly detecting, analyzing, and responding to security incidents. You will be at the forefront of safeguarding sensitive data and systems, working with advanced tools and methodologies to contain threats and minimize impact. This is an excellent opportunity for a proactive security professional to grow their career within a dynamic environment in Soweto, Gauteng, with a hybrid work arrangement.

Key Responsibilities

• Monitor security alerts and events from various security tools (SIEM, IDS/IPS, EDR) to identify potential security incidents.
• Investigate and analyze security incidents, determining their scope, impact, and root cause.
• Perform timely containment, eradication, and recovery of compromised systems and data.
• Conduct forensic analysis of security breaches, including malware analysis and log examination.
• Develop and maintain incident response playbooks and procedures.
• Collaborate with internal teams (IT, Legal, Communications) and external stakeholders during incident response activities.
• Contribute to threat intelligence gathering and analysis to enhance detection capabilities.
• Participate in post-incident reviews to identify lessons learned and implement improvements.
• Stay up-to-date with the latest security threats, vulnerabilities, and incident response techniques.
• Assist in vulnerability management activities and remediation efforts.

Requirements

• Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or a related field, or equivalent practical experience.
• Minimum of 3 years of experience in information security, with a strong focus on incident response or security operations.
• Hands‑on experience with SIEM, EDR, network analysis tools, and forensic tools.
• Understanding of common attack vectors, malware, and threat actor methodologies.
• Proficiency in analyzing system logs, network traffic, and endpoint data.
• Knowledge of incident response frameworks and best practices.
• Scripting skills (e.g., Python) for automation are a plus.
• Strong analytical and problem‑solving abilities with meticulous attention to detail.
• Excellent communication and interpersonal skills, with the ability to work effectively under pressure.
• Relevant certifications such as CompTIA Security+, CEH, or GCIH are advantageous.
• Ability to work effectively in a hybrid capacity in Soweto, Gauteng.

Benefits

• Competitive annual salary package.
• Comprehensive medical aid and retirement fund benefits.
• Opportunities for professional development, training, and certifications.
• Generous annual leave allowance.
• Access to advanced security tools and technologies.
• Supportive team environment focused on continuous learning and improvement.