Onsite Senior SOC Analyst: Incident Response & Forensics

Forensic Focus Limited; Randburg; On-site; ZAR 600,000 - 900,000; Full time

Job summary

Forensic Focus Limited in Randburg, Gauteng, South Africa, is seeking a Senior Security Operations Centre Analyst to lead end-to-end incident response and digital forensics investigations, handling evidence acquisition, timeline construction, malware triage, and reporting.

Between incidents, you will drive threat hunting and detection engineering, collaborate with purple teams, and manage escalation while mentoring junior analysts in a demanding, hands-on role.

Qualifications

• Expert-level artifact analysis across Windows, Linux, and macOS.
• Strong PCAP and network forensics skills.
• Hands-on experience with Microsoft Sentinel, Splunk, and Microsoft Defender.
• Forensic tooling such as Magnet AXIOM, FTK, or Autopsy is required.
• Scripting in Python or PowerShell.
• OSCP or CEH certifications are preferred.

Responsibilities

• Lead end-to-end incident response and digital forensics investigations.
• Evidence acquisition, multi-source timeline construction, malware triage, and reporting.
• Own threat hunting, detection engineering, purple team collaboration, and escalation handling.

Skills

Artifact analysis

PCAP & network forensics

Windows/Linux/macOS forensics

Tools

Magnet AXIOM

FTK

Autopsy

Python

PowerShell

Microsoft Sentinel

Splunk

Microsoft Defender

Job description

Forensic Focus Limited in Randburg, Gauteng, South Africa, is seeking a Senior Security Operations Centre Analyst to lead end-to-end incident response and digital forensics investigations, handling evidence acquisition, timeline construction, malware triage, and reporting.

Between incidents, you will drive threat hunting and detection engineering, collaborate with purple teams, and manage escalation while mentoring junior analysts in a demanding, hands-on role.