L2 SOC Analyst | Incident Response & Threat Hunting

Integrity360; Cape Town; On-site; ZAR 420,000 - 640,000; Full time

Job summary

Integrity360 is seeking an experienced Incident Response Analyst to join its cybersecurity team in Cape Town. You will investigate incidents, triage alerts, and collaborate with clients to navigate security events, with a focus on Blue Team operations.

Ideal candidates have 2–4 years in a SOC/CSIRT environment, strong log analysis skills, networking knowledge, and experience with SIEM tools such as Splunk, QRadar or Elastic Stack. On-site work is expected in most circumstances.

Qualifications

• 2–4 years of cybersecurity experience in a SOC/CSIRT or similar.
• Experience with security log investigations using multiple sources.
• Solid networking knowledge to understand network-related attacks.
• Familiarity with SIEM technologies such as Splunk, QRadar, Elastic Stack.
• Knowledge of the attack chain and incident response is beneficial.

Responsibilities

• Triage security alerts and conduct investigations to identify root causes.
• Collaborate with the team to investigate incidents and communicate findings.
• Regularly review detection rules with the Detection team to minimize false positives.
• Assist with incident response workflows, automation and orchestration.
• Identify and document vulnerabilities; contribute to incident reports.
• Maintain clear, professional client communication throughout the lifecycle.

Skills

SOC/CSIRT experience

Security log analysis

Networking fundamentals

SIEM skills

Digital forensics

IR knowledge

Education

Bachelor's degree in CS/IT

Tools

Splunk

QRadar

Elastic Stack

Job description

Integrity360 is seeking an experienced Incident Response Analyst to join its cybersecurity team in Cape Town. You will investigate incidents, triage alerts, and collaborate with clients to navigate security events, with a focus on Blue Team operations.

Ideal candidates have 2–4 years in a SOC/CSIRT environment, strong log analysis skills, networking knowledge, and experience with SIEM tools such as Splunk, QRadar or Elastic Stack. On-site work is expected in most circumstances.