Security Analyst – Tier 2

AiR; Cape Town; On-site; ZAR 400,000 - 600,000; Full time

Benefits offered by this job

Uncapped leave

Comprehensive benefits package

Growth opportunities

Job summary

AiR in Cape Town is seeking a Security Operations/Incident Response professional to defend against evolving cyber threats using the Microsoft security stack, AI, and automation. You will monitor, detect, and respond to security alerts across M365 and Azure to protect the organization and its customers.

The ideal candidate has 3+ years in security operations, hands-on with Microsoft Sentinel, Defender, and Entra ID, and knowledge of MITRE ATT&CK.

Qualifications

• 3+ years in Security Operations or Incident Response
• Experience with Microsoft Sentinel and KQL
• Hands-on with Microsoft Defender (Endpoint, Office 365) & Entra ID
• Understanding of MITRE ATT&CK and common attack vectors
• Excellent analytical and communication skills
• Certifications: CompTIA CySA+ or Microsoft SC-200

Responsibilities

• Investigate and respond to escalated security alerts across M365 and Azure
• Develop detection rules and automation playbooks
• Mentor junior analysts and improve security processes
• Coordinate incident response and remediation efforts

Skills

Security Operations

Incident Response

MITRE ATT&CK

KQL

Mentoring junior analysts

Analytical skills

Education

CompTIA CySA+

Microsoft SC-200

Tools

Microsoft Sentinel

Microsoft Defender for Endpoint

Defender for Office 365

Entra ID

Job description

Help us defend against evolving cyber threats using cutting-edge Microsoft Security stack, AI, and automation. You'll be at the forefront of protecting our organization and customers from sophisticated attacks.

What We’re Looking For

• - 3+ years in Security Operations or Incident Response
• - Strong experience with Microsoft Sentinel and KQL
• - Hands‑on with Microsoft Defender (Endpoint, Office 365) & Entra ID
• - Understanding of MITRE ATT&CK and common attack vectors
• - Excellent analytical and communication skills
• - CompTIA CySA+ or Microsoft SC-200 certification

What You’ll Do

• - Investigate and respond to escalated security alerts across M365 and Azure
• - Develop detection rules and automation playbooks
• - Mentor junior analysts and improve security processes
• - Coordinate incident response and remediation efforts

Why You’ll Love It

• - **Impactful work** defending a growing organization
• - **Uncapped leave** and comprehensive benefits package
• - **Growth opportunities** with continuous learning and mentoring