Security Operations Centre (SOC) Engineer

Recruit-It; Wes-Kaap; On-site; ZAR 180,000 - 240,000; Full time

Job summary

Recruit-It is seeking a technically strong first-line engineer to join our security operations team in the Western Cape. You will monitor security alerts, perform initial investigations, log findings and escalate where required to keep clients secure.

The ideal candidate has IT support experience, strong troubleshooting, and a solid understanding of Microsoft environments, tickets and SLAs. Development of security capability is a key goal; relevant certifications such as CompTIA Security+,

Qualifications

• Experience in IT support/service desk environment.
• Strong troubleshooting skills.
• Understanding of Microsoft environments.
• Experience working with tickets, priorities and SLAs.
• Good written and verbal communication skills.
• Interest in developing security capability.

Responsibilities

• Security Monitoring & Incident Detection: Continuously monitor security tools and alerting platforms; review alerts; identify suspicious activity; escalate according to processes.
• Security incident triage and response: Assess and validate incidents; perform initial investigation and impact assessment; support containment; maintain records; escalate when needed.
• After-hours 1st line service desk coverage: Provide first-line support for 24/7 clients outside business hours; log and categorize requests; basic troubleshooting; progress tickets with ownership.
• Escalation and handover management: Follow escalation routes; ensure accurate information and context; engage senior engineers; support smooth handovers.
• Security and incident reporting: Maintain documentation; track incidents and trends; contribute to reporting and improvements.

Job description

What success looks like:

• Security alerts are monitored, assessed and responded to appropriately.
• Security incidents are accurately identified, documented and escalated.
• 24/7 clients receive consistent and professional after-hours support.
• Tickets and incidents have clear ownership and progression.
• Escalations contain sufficient technical context to enable efficient resolution.
• Security trends, recurring issues and risks are identified and reported.

Core accountabilities:

Security Monitoring & Incident Detection

• Continuously monitor security tools and alerting platforms.
• Review security alerts and determine appropriate action.
• Identify suspicious activity and potential threats.
• Escalate security concerns according to defined processes

Security incident triage and response:

• Assess and validate security incidents.
• Perform initial investigation and impact assessment.
• Support containment activities within agreed processes.
• Maintain accurate incident records and investigation notes.
• Escalate incidents requiring additional expertise or authority.

After-hours 1st line service desk coverage:

• Provide first-line support for contracted 24/7 clients outside standard business hours.
• Answer, log and categorise incoming requests.
• Perform basic troubleshooting and resolution within agreed capability.
• Progress tickets appropriately and maintain ownership.

Escalate technical issues to senior engineers where required

Escalation and handover management:

• Follow defined escalation routes for technical and security issues.
• Ensure escalations contain accurate information, troubleshooting completed and relevant context.
• Engage senior engineers and management when required based on impact or complexity.
• Support smooth handover between teams.

Security and incident reporting

• Maintain accurate security and service documentation.
• Track security incidents, trends, and recurring issues.
• Contribute to incident reporting and service improvement activities.
• Identify opportunities to improve monitoring, processes and knowledge sharing.

Key Performance Indicators (KPIs):

Security and service performance:

• Security alerts and tickets responded to within agreed SLA
• After-hours client support delivered within agreed SLA
• Security incidents progressed within expected timescales

Ownership and quality:

• 100% of tickets/incidents have clear ownership and next action
• Ticket and incident notes meet quality standards
• Reduction in avoidable rework or missed information

Escalation management:

• Correct escalation of technical and security issues
• Quality of handovers to wider service desk team
• Issues escalated before becoming client-impacting

Security improvement:

• Recurring issues identified and reported
• Contribution to security documentation, processes and knowledge sharing

Team and capability development:

• Completion of agreed training and certifications
• Development of technical and security skills

Technical requirements

Essential:

• Experience within an IT support/service desk environment.
• Strong troubleshooting skills.
• Understanding of Microsoft environments.
• Experience working with tickets, priorities and SLAs.
• Good written and verbal communication skills.
• Interest in developing security capability

Advantageous:

• Exposure to:
• Microsoft Defender
• Microsoft 365 security
• Endpoint security tools
• Firewalls
• Identity and access management

Experience and development

• The ideal candidate will be a technically strong first-line engineer or junior second-line engineer looking to develop into security operations.
• Experience within an MSP environment is advantageous. Relevant certifications are beneficial but not essential including:
• CompTIA Security +
• Microsoft SC-900
• Microsoft SC-200
• MD-102
• MS-102
• CompTIA Network+