Cyber Incident Response Lead

Salix Recruitment; Gauteng; On-site; ZAR 900,000 - 1,500,000; Full time

Job summary

Salix Recruitment is seeking an experienced Cyber Risk Incident Manager for a longstanding South African organisation with a global footprint. You will lead incident response within a SOC environment and drive remediation across IT and security teams.

You will own containment, coordinate vulnerability management, and oversee cross-functional collaboration with DevSecOps, Risk & Compliance, Service Desk and IT Infrastructure to strengthen security resilience.

Qualifications

• Six to ten years in cybersecurity operations.
• Hands-on incident response and threat remediation.
• Experience with SOC, virtual or outsourced SOC.

Responsibilities

• Lead remediation and resolution of incidents identified by the SOC.
• Coordinate vulnerability remediation and patch management across IT teams.
• Track and ensure vulnerabilities are resolved within set timelines.
• Maintain EDR and network segmentation controls.
• Develop and maintain incident response playbooks and workflows.
• Improve SOC alert handling and reporting to reduce false positives.
• Monitor third-party SOC and security providers against SLAs.
• Collaborate with IT, Service Desk, DevSecOps, and Risk & Compliance.
• Verify incident closure and patching work; support audits.

Skills

Incident response leadership

SOC operations

EDR and network security

Threat remediation

Vulnerability management

Patch management

Strong communication

Education

Bachelor’s degree (Info Sec / CS / IT)

Matric (Grade 12)

Tools

SAP

Active Directory

Hybrid Cloud

Job description

Salix Recruitment is seeking an experienced Cyber Risk Incident Manager for a longstanding South African organisation with a global footprint. You will lead incident response within a SOC environment and drive remediation across IT and security teams.

You will own containment, coordinate vulnerability management, and oversee cross-functional collaboration with DevSecOps, Risk & Compliance, Service Desk and IT Infrastructure to strengthen security resilience.