Security Analyst II: Threat Defender & Automation

AiR; Cape Town; On-site; ZAR 400,000 - 600,000; Full time

Benefits offered by this job

Uncapped leave

Comprehensive benefits package

Growth opportunities

Job summary

AiR in Cape Town is seeking a Security Operations/Incident Response professional to defend against evolving cyber threats using the Microsoft security stack, AI, and automation. You will monitor, detect, and respond to security alerts across M365 and Azure to protect the organization and its customers.

The ideal candidate has 3+ years in security operations, hands-on with Microsoft Sentinel, Defender, and Entra ID, and knowledge of MITRE ATT&CK.

Qualifications

• 3+ years in Security Operations or Incident Response
• Experience with Microsoft Sentinel and KQL
• Hands-on with Microsoft Defender (Endpoint, Office 365) & Entra ID
• Understanding of MITRE ATT&CK and common attack vectors
• Excellent analytical and communication skills
• Certifications: CompTIA CySA+ or Microsoft SC-200

Responsibilities

• Investigate and respond to escalated security alerts across M365 and Azure
• Develop detection rules and automation playbooks
• Mentor junior analysts and improve security processes
• Coordinate incident response and remediation efforts

Skills

Security Operations

Incident Response

MITRE ATT&CK

KQL

Mentoring junior analysts

Analytical skills

Education

CompTIA CySA+

Microsoft SC-200

Tools

Microsoft Sentinel

Microsoft Defender for Endpoint

Defender for Office 365

Entra ID

Job description

AiR in Cape Town is seeking a Security Operations/Incident Response professional to defend against evolving cyber threats using the Microsoft security stack, AI, and automation. You will monitor, detect, and respond to security alerts across M365 and Azure to protect the organization and its customers.

The ideal candidate has 3+ years in security operations, hands-on with Microsoft Sentinel, Defender, and Entra ID, and knowledge of MITRE ATT&CK.