Security Operations Centre Analyst

Forensic Focus Limited; Randburg; On-site; ZAR 600,000 - 900,000; Full time

Job summary

Forensic Focus Limited in Randburg, Gauteng, South Africa, is seeking a Senior Security Operations Centre Analyst to lead end-to-end incident response and digital forensics investigations, handling evidence acquisition, timeline construction, malware triage, and reporting.

Between incidents, you will drive threat hunting and detection engineering, collaborate with purple teams, and manage escalation while mentoring junior analysts in a demanding, hands-on role.

Qualifications

• Expert-level artifact analysis across Windows, Linux, and macOS.
• Strong PCAP and network forensics skills.
• Hands-on experience with Microsoft Sentinel, Splunk, and Microsoft Defender.
• Forensic tooling such as Magnet AXIOM, FTK, or Autopsy is required.
• Scripting in Python or PowerShell.
• OSCP or CEH certifications are preferred.

Responsibilities

• Lead end-to-end incident response and digital forensics investigations.
• Evidence acquisition, multi-source timeline construction, malware triage, and reporting.
• Own threat hunting, detection engineering, purple team collaboration, and escalation handling.

Skills

Artifact analysis

PCAP & network forensics

Windows/Linux/macOS forensics

Tools

Magnet AXIOM

FTK

Autopsy

Python

PowerShell

Microsoft Sentinel

Splunk

Microsoft Defender

Job description

# Security Operations Centre Analyst*FNB South Africa***Randburg, Gauteng**Onsite · Senior · Full-time### The RoleOperating as a SOC Level 3 analyst, this position leads end-to-end incident response and digital forensics investigations, covering evidence acquisition, multi-source timeline construction, malware triage, and detailed reporting. Between incidents, the analyst owns threat hunting, detection engineering, purple team collaboration, and escalation handling.### Skills & ExperienceCandidates need expert-level artifact analysis across Windows, Linux, and macOS, strong PCAP and network forensics skills, and hands-on experience with Microsoft Sentinel, Splunk, and Microsoft Defender. Forensic tooling such as Magnet AXIOM, FTK, or Autopsy is required, alongside scripting in Python or PowerShell. OSCP or CEH certifications are preferred.### Who It SuitsThis role suits an experienced DFIR professional with a SOC background who is comfortable leading complex investigations independently, mentoring junior analysts, and contributing to detection engineering. Those with both defensive and offensive security experience will thrive in this technically demanding, senior-level position.