Security Operations Centre Analyst Level 1

Derivco; Cape Town; On-site; ZAR 300,000 - 420,000; Full time

Job summary

Derivco in Cape Town seeks a motivated SOC Analyst (Level 1) to monitor live systems, analyse security events, and contribute to early detection and response of incidents. This hands-on role is the first line of defence, working with SOC tools, playbooks, and response teams to protect enterprise‑scale data and assets.

You will gain practical experience in security monitoring, incident management, and escalation, collaborate with senior analysts, and help improve processes and tooling.

Qualifications

• 1–2 years in Security Operations or cyber security.
• Diploma or degree in IT or CS.
• Foundational information security knowledge and best practices.

Responsibilities

• Monitor security systems to detect potential cyber security incidents.
• Analyse and validate security alerts, distinguishing real threats from false positives.
• Escalate confirmed or unknown incidents per SOC playbooks and SLA.
• Communicate incident details to security response teams and stakeholders.
• Assist senior analysts during containment, eradication and recovery.
• Track and document incidents to maintain reliable security records.
• Monitor systems post-incident to ensure normal operation.
• Support threat intelligence research to identify emerging risks.
• Identify and elevate risks affecting SOC service quality or response times.
• Contribute to improving SOC processes, tools and monitoring effectiveness.

Education

IT/CS degree

1–2 years in Security Operations

Tools

SIEM

IDS/IPS

Firewalls

Endpoint monitoring

Job description

We’re looking for a motivated Security Operations Centre (SOC) Analyst (Level 1) who enjoys monitoring live systems, analysing security events, and contributing to the early detection and response of cyber security incidents.

This is a hands‑on role where you’ll be the first line of defence, working closely with security tools, playbooks, and response teams to help protect enterprise‑scale systems, data, and digital assets.

What You’ll Do

• Monitor security systems and tools to detect potential cyber security incidents
• Analyse and validate security alerts, distinguishing real threats from false positives
• Escalate confirmed or unknown incidents in line with SOC playbooks and SLA requirements
• Communicate incident details clearly to security response teams and internal stakeholders
• Assist senior analysts during incident containment, eradication, and recovery activities
• Track and document incidents accurately to maintain reliable security records
• Monitor systems post‑incident to confirm normal operation and successful resolution
• Support threat intelligence research to identify emerging risks and attack patterns
• Identify and elevate risks that may impact SOC service quality or response times
• Contribute to improving SOC processes, tools, and monitoring effectiveness

What We’re Looking For

• 1–2 years of experience in Security Operations, Cyber Security, or a related field
• A relevant diploma or degree in IT, Computer Science, or a related discipline
• Foundational knowledge of information security principles, controls, and best practices
• Familiarity with security monitoring, incident management, and escalation processesExposure to SOC tools such as:
  • SIEM platforms
  • IDS/IPS
  • Firewalls and web application firewalls
  • Endpoint and monitoring solutions
• An understanding of SLAs and the importance of timely detection and response
• Strong attention to detail and the ability to follow defined processes and playbooks
• Clear verbal and written communication skills
• A calm, methodical approach to problem‑solving and decision‑making
• A collaborative mindset with a willingness to learn, improve, and grow in cyber security

Why Join Us?

• Gain hands‑on experience in a real‑world, enterprise‑scale Security Operations Centre
• Build strong foundations in cyber security monitoring and incident response
• Work alongside experienced analysts in a supportive, team‑focused environment
• Develop in‑demand skills using modern security tools, processes, and frameworks
• Be part of a culture that values responsibility, learning, precision, and continuous improvement

Closing Date: 30 October 2026