Cyber Security SOC Engineer

Sasso Consulting; Johannesburg; Hybrid; ZAR 480,000 - 720,000; Full time

Job summary

Sasso Consulting is seeking experienced Cyber Security SOC Engineers to design, implement, configure and maintain enterprise security monitoring and threat detection technologies. You will build and optimise the SOC infrastructure, including SIEM, EDR/XDR, cloud integrations and automation, to support reliable, actionable security data for analysts.

The role emphasizes hands-on SOC engineering, detection engineering and integration across security tools, with a focus on scalable architecture and

Qualifications

• Experience in SOC engineering and security monitoring platforms.
• Proven practical experience with enterprise SIEM deployment and administration.
• Hands-on knowledge of EDR/XDR technologies and SOAR workflows.
• Strong understanding of log ingestion, data parsing and correlation.
• Familiarity with MITRE ATT&CK framework.
• Experience with cloud security monitoring in hybrid environments.
• Strong technical documentation and problem-solving skills.

Responsibilities

• Design, implement and maintain SOC monitoring infrastructure.
• Deploy SIEM, EDR, XDR and related security monitoring technologies.
• Develop detection rules and alerting.
• Configure log collectors and data ingestion pipelines.
• Integrate security tools and cloud services with SIEM.
• Monitor and optimise SIEM performance.
• Provide operational support and platform upgrades.
• Collaborate with SOC analysts and security teams.
• Implement SOAR workflows and automation.

Skills

SOC engineering

SIEM administration

EDR

XDR

SOAR engineering

Security automation

Cloud security monitoring

Threat detection

Scripting

MITRE ATT&CK

Windows/Linux

Education

Information Technology / Cybersecurity degree

Tools

Microsoft Sentinel

Splunk

IBM QRadar

Elastic Security

ArcSight

LogRhythm

Job description

Location: Gauteng

Positions Available: 5

Salary: Market-related

Employment type: 3 Year contract, hybrid

Job Overview

We are seeking experienced and technically proficient Cyber Security Security Operations Centre (SOC) Engineers to design, implement, configure, integrate, maintain and optimise enterprise security monitoring and threat detection technologies.

The successful candidates will be responsible for developing and maintaining the technical infrastructure that supports Security Operations Centre operations, including Security Information and Event Management (SIEM) platforms, Endpoint Detection and Response (EDR) solutions, security automation technologies and enterprise log management systems.

This role requires strong hands-on expertise in SOC engineering, SIEM administration, security monitoring architecture, detection engineering, log ingestion, security tool integration and cybersecurity automation.

The ideal candidates will have proven experience implementing and supporting enterprise security monitoring platforms, developing detection capabilities and ensuring that cybersecurity analysts have access to reliable, accurate and actionable security information.

Unlike a SOC Analyst, whose primary responsibility is investigating security alerts, a SOC Engineer focuses on building, configuring, maintaining and improving the security technologies and detection capabilities used by the SOC.

Key Responsibilities

SOC Infrastructure Design and Implementation

• Design, implement, configure and maintain enterprise SOC security monitoring infrastructure.
• Deploy and administer SIEM, EDR, XDR and related security monitoring technologies.
• Develop and maintain scalable security monitoring architectures.
• Configure security event collection, processing, correlation and retention.
• Integrate security monitoring solutions with enterprise infrastructure and cloud platforms.
• Ensure security monitoring technologies remain available, reliable and appropriately secured.
• Support SOC platform upgrades, migrations and infrastructure improvements.
• Implement security monitoring standards and operational procedures.
• Collaborate with SOC analysts, security architects and infrastructure teams to improve monitoring capabilities.
• Identify technical weaknesses in SOC infrastructure and recommend improvements.

SIEM Engineering and Administration

• Install, configure, administer and optimise enterprise SIEM platforms.
• Integrate security logs from servers, endpoints, firewalls, network devices, applications and cloud services.
• Configure log collectors, agents, connectors and data ingestion pipelines.
• Develop and maintain SIEM correlation rules, detection logic and alerting mechanisms.
• Configure security dashboards, reporting and monitoring views.
• Optimise SIEM performance, data ingestion, storage and query efficiency.
• Troubleshoot log collection failures, parsing issues and integration problems.
• Monitor SIEM platform health and availability.
• Implement appropriate access controls and administrative security measures.
• Support SIEM upgrades, platform migrations and configuration management.

Detection Engineering and Security Analytics

• Develop, implement and maintain cybersecurity detection rules and use cases.
• Translate threat intelligence and attacker techniques into actionable detection logic.
• Map security detection capabilities to the MITRE ATT&CK framework.
• Develop detection content for malware, ransomware, credential compromise, privilege escalation and lateral movement.
• Create and optimise SIEM queries and correlation searches.
• Validate detection rules using controlled testing and attack simulations.
• Reduce false positives and improve alert accuracy.
• Identify gaps in security telemetry and detection coverage.
• Collaborate with SOC analysts, threat hunters and incident responders to improve detection effectiveness.
• Maintain detection documentation, testing evidence and version‑controlled detection content.

EDR, XDR and Security Tool Integration

• Deploy, configure and maintain enterprise endpoint detection and response technologies.
• Integrate EDR and XDR platforms with SIEM and incident response systems.
• Configure endpoint security policies, monitoring rules and alerting mechanisms.
• Troubleshoot endpoint agent deployment and communication issues.
• Integrate firewalls, intrusion detection systems and other security technologies with SOC monitoring platforms.
• Support network detection and response capabilities.
• Maintain security tool connectivity and integration health.
• Implement appropriate access controls and security configurations.
• Assist with security platform upgrades and technical improvements.

Security Automation and SOAR Engineering

• Design, implement and maintain Security Orchestration, Automation and Response (SOAR) workflows.
• Develop automated incident enrichment, alert triage and investigation processes.
• Integrate SIEM, EDR, threat intelligence and ticketing platforms.
• Develop and maintain incident response automation playbooks.
• Use APIs and scripting to automate repetitive SOC activities.
• Implement automated indicator enrichment and threat intelligence lookups.
• Test and validate security automation workflows.
• Ensure automated response actions include appropriate approvals and safeguards.
• Troubleshoot security automation failures and integration issues.
• Identify opportunities to improve SOC operational efficiency through automation.

Cloud and Hybrid Security Monitoring

• Implement security monitoring across Microsoft Azure, AWS or Google Cloud environments.
• Configure cloud security log collection and event monitoring.
• Integrate cloud security technologies with enterprise SIEM platforms.
• Monitor cloud identity, workloads, applications and infrastructure.
• Configure security monitoring for Microsoft Entra ID and Microsoft 365 environments.
• Support cloud‑native threat detection and incident investigation capabilities.
• Develop detection rules for cloud security threats and suspicious activities.
• Ensure appropriate monitoring coverage across hybrid infrastructure.
• Collaborate with cloud engineering and cybersecurity teams to improve cloud security visibility.

SOC Platform Performance and Operational Support

• Monitor SOC infrastructure health, performance and availability.
• Investigate and resolve security monitoring platform failures.
• Maintain system configurations, technical documentation and operational procedures.
• Support disaster recovery and resilience planning for critical SOC technologies.
• Conduct platform health checks, configuration reviews and capacity assessments.
• Support security technology patching and vulnerability remediation.
• Maintain appropriate change management and configuration control processes.
• Provide technical support to SOC analysts and incident response teams.
• Recommend improvements to security monitoring architecture and operational effectiveness.

Security Governance and Compliance

• Ensure SOC engineering practices align with organisational security policies.
• Support security monitoring requirements under ISO 27001, NIST and other applicable frameworks.
• Maintain audit logs, technical documentation and security monitoring evidence.
• Assist with internal and external cybersecurity audits.
• Support data retention, access control and security logging requirements.
• Maintain technical standards for SIEM configuration and security tool integration.
• Recommend improvements to SOC engineering processes and security controls.
• Support continuous improvement of enterprise security monitoring capabilities.

Minimum Requirements

• Relevant diploma or degree in Information Technology, Computer Science, Cybersecurity, Information Security, Network Engineering or a related discipline.
• Typically 3-5 years of relevant hands-on experience in SOC engineering, SIEM engineering, security infrastructure engineering or a closely related cybersecurity specialisation.
• Proven practical experience implementing, configuring or administering enterprise SIEM or security monitoring platforms.
• Strong knowledge of SOC architecture, security event collection and enterprise log management.
• Experience integrating multiple security technologies and log sources into SIEM environments.
• Practical experience developing, configuring or optimising security detection rules and correlation searches.
• Experience with EDR, XDR or related endpoint security technologies.
• Understanding of security event analysis, threat detection and incident response processes.
• Strong knowledge of Windows Server, Linux, Active Directory and enterprise networking.
• Familiarity with cloud security monitoring and hybrid infrastructure environments.
• Experience using scripting or automation to support security operations.
• Understanding of APIs, security tool integration and log ingestion technologies.
• Familiarity with the MITRE ATT&CK framework.
• Experience troubleshooting complex security monitoring and platform integration issues.
• Strong technical documentation, analytical and problem‑solving skills.

Technical Skills and Competencies

SIEM Engineering and Administration

• Microsoft Sentinel
• Splunk Enterprise Security
• IBM QRadar
• Elastic Security
• ArcSight
• LogRhythm
• Google Security Operations
• Other enterprise SIEM platforms

Relevant technical competencies include:

• SIEM deployment and configuration
• Log ingestion and collection
• Log source onboarding
• Data parsing and normalisation
• Security event correlation