Senior SOC Analyst

KHIPU Networks; Wes-Kaap; On-site; ZAR 600,000 - 900,000; Full time

Job summary

KHIPU Networks, an award-winning cyber security company, invites applications for a Senior SOC Analyst to join our 24x7 Blue Team in Cape Town. You will monitor security alerts, drive incident response, and collaborate with a global team to enhance detection, threat intel, and security operations.

You will lead triage and remediation efforts, mentor junior analysts, and help shape SOPs and playbooks while supporting SIEM/EDR deployments and ongoing security improvements.

Qualifications

• 5–10 years of cybersecurity experience in a technical environment.
• Proven SOC/CSIRT experience and incident handling lifecycle knowledge.
• Strong OS and networking expertise with malware understanding.
• Experience leading triage, containment and remediation activities.

Responsibilities

• Monitor, analyse, and investigate security alerts across toolsets.
• Lead incident triage, containment, and remediation for complex incidents.
• Manage cybersecurity incidents through to resolution.
• Develop and optimise detection rules, correlation logic, and playbooks.
• Prepare detailed intelligence reports on investigations, status and risk factors.
• Mentor and train junior SOC analysts.
• Develop and maintain SOPs, use cases, and SOC documentation.
• Manage, configure, maintain, and support security toolsets for coverage.
• Lead onboarding and configuration of SIEM/EDR deployments.
• Ensure SLA/OLA compliance and positive customer engagement.
• Contribute to new services and improvements via project work.

Skills

Incident response

SOC/CSIRT experience

OS (Windows/Linux/Mac)

Network traffic analysis

Mentoring juniors

SOPs / playbooks

SIEM/EDR deployment

Communication skills

Global collaboration

Threat intel awareness

Education

Blue Team Level 1/2

CREST CRSA

CySA+

CASP+

Palo Alto certifications

GCIH

Job description

KHIPU Networks is an award-winning, and highly successful Cyber Security company based in the UK and Africa. We offer outstanding opportunities for candidates of all levels within a dynamic and flexible working environment. Founded in 2005, KHIPU Networks’ ethos has always been to work in partnership with customers, to understand their environments and challenges so that we can design and deploy ‘Best of Breed’ solutions that enable them to meet their strategic goals.

KHIPU Networks is a privately owned award-winning international Cyber Security Company delivering a wide range of network, wireless and security solutions, technologies and services across multiple sectors. We are honoured to be by Royal Appointment to His Majesty the King, and are proud to be an ISO9001, ISO27001, ISO14001 and ISO45001 certified company. We also support the National Apprenticeship Scheme, employing and developing apprentices within all sectors of the company.

About the role

Are you interested in furthering your career in the cybersecurity industry? If so, we want to hear from you! We are currently seeking a motivated, innovative and dedicated Senior SOC Analyst to join our 24x7 Blue Team in Cape Town to ensure the growth and development of our SOC.

You will be part of a Global SOC team, working with both mainstream manufacturers and niche players. Each day offers new challenges and learning opportunities, and in return we offer development and training in a modern technical working environment. This is an exciting opportunity to further develop your cybersecurity career. It could be required from the position to join a 24x7 shift pattern, working shifts and/or be on standby when required.

Key Responsibilities

• Monitor, analyse, and investigate security alerts across all security toolsets.
• Lead triage, containment, and remediation activities for complex incidents.
• Manage cybersecurity incidents through to resolution.
• Develop and optimise detection rules, correlation logic, playbooks, and automations.
• Prepare detailed intelligence reports, providing information on findings, status and progress of investigations, as well as vulnerability and risk factors
• Act as escalation point, mentor and train junior SOC analysts
• Develop and maintain Standard Operating Procedures (SOPs), use cases and SOC documentation.
• Manage, configure, maintain and support security toolsets to ensure optimal use and coverage
• Lead the onboarding, implementation, and configuration of SIEM/EDR deployments.
• Ensure SLA/OLA compliance and support positive customer engagement.
• Participate in developing new services and improving existing ones via project work

Required Experience and Skills

• Demonstrable experience leading incident response activities following well known IR lifecycles
• 5 - 10 years of cybersecurity experience in a technical environment.
• Proven experience working in a SOC, CSIRT, or equivalent security operations environment.
• Advanced OS knowledge across Windows, Linux and MacOS.
• Advanced networking expertise, including analysis of suspicious network traffic.
• Experience working with and instructing third parties based on investigation findings.
• Strong understanding of incident management and escalation processes.
• Excellent written and verbal communication across technical and non‑technical audiences.
• Experience implementing best‑practice cybersecurity procedures and frameworks.
• Experience working as part of a global team, including external partners.
• Advanced understanding of malware behaviour, attack vectors, propagation methods, and impact.
• Preferred technology experience:
  • Vulnerability scanning tools,
  • Good understanding of:
    • NIST Cybersecurity Framework
    • ISO 27001
    • OWASP Top 10
    • CIS Top 20
  • Knowledge of system administration, scripting, and OS hardening techniques.
  • Strong analytical skills with the ability to assess cyber risks and define mitigation plans.

Academic qualifications and certifications:

• Blue Team Level 1 and 2 or equivalent - required
• CREST Registered SOC Analyst (CRSA) or equivalent - required
• CompTIA Cybersecurity Analyst (CySA +) or equivalent - required
• CompTIA Advanced Security Practitioner (CASP+) or equivalent - required
• Palo Alto certifications – preferred
• SANS GIAC Certified Incident Handler (GCIH) or equivalent - preferred

Shortlisted candidates will be required to complete a competency assessment.