Cybersecurity Analyst L2

Private Business; Cape Town; On-site; ZAR 420,000 - 600,000; Full time

Job summary

Private Business in Century City, Cape Town is seeking an L2 SOC Analyst to join a busy cybersecurity team within a multi-client MSP/MSSP setup.

You will investigate alerts, perform threat hunting, fine-tune SIEM rules, and contribute to detection coverage using Microsoft Sentinel and KQL across diverse client environments.

Qualifications

• 2-4 years' practical cybersecurity / SOC experience.
• Experience in MSP/MSSP or multi-client environment.
• Strong hands-on experience with Microsoft Sentinel.
• Practical KQL experience.
• SIEM alert investigation and incident response experience.

Responsibilities

• Investigate and analyse security alerts and incidents across multiple client environments.
• Perform L2 SOC investigations and determine the nature, severity and potential impact of security events.
• Work with Microsoft Sentinel and KQL for incident investigation, log analysis, threat hunting and detection development.
• Review, tune and improve SIEM detection rules and identify detection gaps.
• Contribute to MITRE ATT&CK mapping and detection coverage assessments.
• Conduct proactive threat hunting and contribute to monthly threat-hunting reporting.
• Analyse EDR/XDR alerts and endpoint security events.
• Investigate Microsoft 365, Entra ID, endpoint, email and network security events.
• Assist with vulnerability management, security hardening and remediation activities.
• Support SIEM onboarding, optimisation and cybersecurity projects.
• Produce technical and client-facing security reports and recommendations.
• Work across multiple clients and technologies while prioritising incidents and tasks according to risk and business impact.
• Maintain accurate technical documentation and investigation records.

Skills

Microsoft Sentinel

KQL

SIEM

EDR/XDR

MITRE ATT&CK

Networking

Windows security

English communication

Tools

Tenable

Fortinet FortiGate

Cisco security technologies

SentinelOne

Sophos

Job description

Our global client is looking for a technically capable L2 SOC Analyst / Cybersecurity Analyst to join the Cybersecurity team based in Century City, Cape Town. To support multiple client environments within our MSP/MSSP operation.

This role will go beyond basic SOC alert monitoring. The successful candidate will independently investigate security alerts and incidents, analyse security telemetry, perform threat hunting, contribute to SIEM and detection improvements, and support a range of cybersecurity projects across their client base.

The candidate must be comfortable working across multiple technologies, clients and competing priorities and should be capable of working independently with limited supervision.

Key Responsibilities

• Investigate and analyse security alerts and incidents across multiple client environments.
• Perform L2 SOC investigations and determine the nature, severity and potential impact of security events.
• Work with Microsoft Sentinel and KQL for incident investigation, log analysis, threat hunting and detection development.
• Review, tune and improve SIEM detection rules and identify detection gaps.
• Contribute to MITRE ATT&CK mapping and detection coverage assessments.
• Conduct proactive threat hunting and contribute to monthly threat-hunting reporting.
• Analyse EDR/XDR alerts and endpoint security events.
• Investigate Microsoft 365, Entra ID, endpoint, email and network security events.
• Assist with vulnerability management, security hardening and remediation activities.
• Support SIEM onboarding, optimisation and cybersecurity projects.
• Produce technical and client-facing security reports and recommendations.
• Work across multiple clients and technologies while prioritising incidents and tasks according to risk and business impact.
• Maintain accurate technical documentation and investigation records.

Core Technical Requirements

• 2-4 years' practical cybersecurity / SOC experience.
• Experience working in an MSP, MSSP or multi-client environment.
• Strong hands-on experience with Microsoft Sentinel.
• Practical KQL experience.
• SIEM alert investigation and incident response experience.
• EDR/XDR experience.
• Strong understanding of security monitoring and log analysis.
• Understanding of MITRE ATT&CK.
• Good understanding of networking, Windows and Microsoft security technologies.
• Strong analytical, problem-solving and documentation skills.

Advantageous

• Sentinel detection engineering and Content Hub.
• Threat hunting.
• Detection rule development and optimisation.
• Power BI / cybersecurity dashboards.
• Vulnerability management / Tenable.
• Fortinet / FortiGate.
• Cisco security technologies.
• SentinelOne / Sophos.
• Security assessments and hardening.
• Experience with additional SIEM platforms

The candidate must also be comfortable working across multiple clients, SIEMs, security technologies and projects, rather than being focused on a single platform or environment.

Key Attributes

• Self-motivated and able to work independently.
• Strong analytical and investigative mindset.
• Rational and critical thinking is a must
• Comfortable troubleshooting unfamiliar security issues.
• Strong prioritisation and decision-making skills.
• Able to manage multiple clients and competing priorities.
• Strong written and verbal communication in English
• Able to explain technical security issues clearly.
• Detail-oriented and methodical.
• Willing to continuously develop technical skills.
• Comfortable working under pressure.
• Takes ownership rather than relying on constant escalation.

Certifications

Relevant certifications are a must but hands-on technical experience will carry greater weight.

• Microsoft SC-200
• Microsoft AZ-500
• Microsoft SC-100
• CompTIA Security+
• CompTIA Network+
• Fortinet certifications
• Relevant SIEM, SOC, threat-hunting or incident-response certifications

We are not looking for someone whose experience is primarily limited to monitoring a SOC dashboard and escalating alerts.

We need an analyst who can investigate, understand, respond and improve.