Lead Security Operations Engineer - SIEM Specialist

Placements24; Cape Town; On-site; ZAR 1,200,000 - 1,800,000; Full time

Benefits offered by this job

Competitive salary and bonuses

Health insurance

Retirement savings plan

Professional growth and training

Access to advanced cybersecurity tools

Cape Town relocation assistance

Career progression pathways

Conferences and training access

Employee assistance program

Job summary

Placements24 seeks a Lead Security Operations Engineer to spearhead SIEM operations in Cape Town. You will architect, deploy, manage, and optimize the enterprise SIEM platform while leading a team of engineers to ensure effective threat detection and rapid incident response.

The role demands extensive SIEM experience (Splunk, QRadar, LogRhythm), solid security monitoring, and incident-handling expertise. This is a strategic opportunity to shape security ops in a vibrant city.

Qualifications

• Bachelor's degree as listed; 7+ years in information security, 4+ years in SIEM engineering/operations.
• Demonstrated experience leading technical teams.
• In-depth knowledge of SIEM platforms (Splunk, QRadar, LogRhythm).
• Strong networking, Windows/Linux, and cloud understanding.
• Experience with scripting for automation (Python, PowerShell).
• GIAC GCSEA or equivalent preferred.

Responsibilities

• Lead design, implementation, and maintenance of the SIEM platform.
• Develop and refine correlation rules, use cases, and alert logic.
• Manage and mentor a team of SIEM engineers and security analysts.
• Oversee ingestion/normalization of log data from diverse sources.
• Conduct threat hunting and forensic investigations using SIEM data.
• Ensure SIEM is scalable, resilient, and optimized.
• Collaborate with Incident Response, Vulnerability Management teams.
• Develop SOPs for SIEM operations and incident handling.
• Evaluate new SIEM technologies and features to improve detection.
• Provide guidance on security monitoring best practices.

Skills

Team leadership

Threat detection

Incident response

Cloud environments

Networking knowledge

Automation scripting

Education

Bachelor's degree in Computer Science / IT / Cybersecurity

Tools

Splunk

QRadar

LogRhythm

Python

PowerShell

Job description

About the Role

Our client is actively seeking a highly experienced Lead Security Operations Engineer to spearhead their Security Information and Event Management (SIEM) operations in Cape Town, Western Cape . This critical leadership role will be responsible for the architecture, deployment, management, and ongoing optimization of the enterprise SIEM platform. You will lead a team of skilled engineers, ensuring the effective detection, analysis, and response to security threats across the organization. The successful candidate will possess extensive expertise in SIEM technologies, security monitoring, and incident detection methodologies. This is an excellent opportunity to shape the future of security operations for a prominent company and to mentor a talented team in one of South Africa's most vibrant cities.

Key Responsibilities

• Lead the design, implementation, and maintenance of the company's SIEM platform.
• Develop and refine correlation rules, use cases, and alert logic to maximize threat detection capabilities.
• Manage and mentor a team of SIEM engineers and security analysts.
• Oversee the ingestion and normalization of log data from diverse sources across the IT infrastructure.
• Conduct advanced threat hunting and forensic investigations utilizing SIEM data.
• Ensure the SIEM environment is scalable, resilient, and performing optimally.
• Collaborate with other security teams (e.g., Incident Response, Vulnerability Management) to enhance overall security posture.
• Develop and document standard operating procedures (SOPs) for SIEM operations and incident handling.
• Evaluate and recommend new SIEM technologies and features to improve detection and response.
• Provide technical guidance and expertise on security monitoring best practices to IT and business units.

Requirements

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field.
• At least 7 years of progressive experience in information security, with a minimum of 4 years focused on SIEM engineering and operations.
• Demonstrated experience leading technical teams.
• In-depth knowledge of SIEM platforms such as Splunk, QRadar, or LogRhythm.
• Strong understanding of networking protocols, operating systems (Windows, Linux), and cloud environments.
• Expertise in security event analysis, threat detection, and incident response.
• Experience with scripting languages (e.g., Python, PowerShell) for automation is essential.
• Excellent analytical, problem-solving, and critical thinking skills.
• Strong communication and interpersonal skills, with the ability to present complex technical information clearly.
• Relevant certifications such as GIAC Certified SIEM Analyst (GCSEA) or equivalent are highly preferred.

Benefits

• Highly competitive salary and performance-based bonuses.
• Comprehensive health insurance and retirement savings plan.
• Significant opportunities for professional growth and continuous learning.
• Exposure to advanced cybersecurity tools and technologies.
• Work within a forward-thinking security team in beautiful Cape Town, Western Cape .
• Generous paid time off and company holidays.
• Relocation assistance may be available for qualified candidates.
• Defined career progression pathways.
• Access to industry conferences and training.
• Employee assistance program and wellness initiatives.