Hybrid SOC Engineer (L2) – Threat Hunting & Automation

60Degrees; Cape Town; Hybrid; ZAR 420,000 - 600,000; Full time

Job summary

60Degrees in Cape Town is seeking a SOC Engineer (L2) to deliver managed security services to clients across South Africa, the UK and the UAE. This role goes beyond alert monitoring, focusing on threat detection engineering, automation, investigation of complex threats, and ongoing improvements to clients' security posture.

You will work with Microsoft Sentinel, Defender XDR and the wider Microsoft stack, solving security challenges and shaping outcomes.

Qualifications

• 2-3+ years in a SOC or Security Operations environment.
• Hands-on live operational SOC experience with incident response.
• Hands-on with Microsoft Sentinel and Defender XDR.
• Experience using KQL for investigations and threat hunting.
• Familiarity with Entra ID and Microsoft security ecosystem.
• Willingness to travel occasionally to UK client sites.

Responsibilities

• Investigating and responding to security alerts and incidents across multiple client environments.
• Designing, improving and tuning detections within Microsoft Sentinel and Defender.
• Conducting proactive threat hunting and security investigations using KQL.
• Developing automation, Logic Apps, playbooks and operational workflows.
• Controlling containment, remediation and recovery during incidents.
• Identifying trends and opportunities to improve detection coverage.
• Assisting onboarding of new security technologies and client environments.
• Collaborating with clients and internal teams to strengthen security operations.

Skills

SOC operations

Microsoft Sentinel

Defender XDR

KQL

Entra ID

Threat hunting

PowerShell

Python

Tools

PowerShell

Python

Job description

60Degrees in Cape Town is seeking a SOC Engineer (L2) to deliver managed security services to clients across South Africa, the UK and the UAE. This role goes beyond alert monitoring, focusing on threat detection engineering, automation, investigation of complex threats, and ongoing improvements to clients' security posture.

You will work with Microsoft Sentinel, Defender XDR and the wider Microsoft stack, solving security challenges and shaping outcomes.