Senior SOC Analyst - Incident Response & Forensics

RMB; Randburg; On-site; ZAR 600,000 - 900,000; Full time

Job summary

FirstRand (RMB) is seeking a highly skilled Security Operations Centre Analyst III to lead incident response and digital forensics across host, network, and application layers. You will act as the SOC L3 bridge for escalations, threat hunts, and mentoring a talented team while advancing detection engineering and telemetry coverage.

Key duties include triage, evidence acquisition, and multi-source timelines with ATT&CK mapping.

Qualifications

• Expert-level log and artifact analysis across Windows/Linux/macOS and web/network layers.
• Proficient PCAP analysis, Network IDS, NetFlow/IPFIX, TLS/DNS telemetry.
• Strong SIEM/EDR skills: MS Sentinel, Splunk, Defender for Endpoint.
• Scripting for data parsing: PowerShell, Python.
• IR methodologies: evidence preservation, timelines, ATT&CK mapping.
• Networking basics: TCP/IP, HTTP, proxies/WAF, SSL/TLS.
• Experience with digital forensics tools: Magnet AXIOM Cyber, FTK, SleuthKit, Autopsy, Redline.
• Knowledge of offensive security concepts and vulnerability identification.

Responsibilities

• Lead end-to-end incident response and forensics across host, network, and app layers.
• Function as SOC L3: own escalations, threat hunts, detection engineering, mentoring.
• Develop and tune SIEM/EDR detections with engineering teams.
• Perform purple teaming to validate detections and response playbooks.
• Maintain IR runbooks, chain-of-custody templates, and evidence vault workflows.
• Provide technical reports and executive summaries with remediation guidance.

Skills

Log analysis

Artifact analysis

Windows

Linux

macOS

PCAP analysis

Network IDS

TLS/DNS telemetry

SIEM

EDR

Scripting

PowerShell

Python

ATT&CK mapping

Forensics

Threat hunting

Detection engineering

Sigma rules

Education

Certification in Cyber security

Splunk certificate

OSCP / Offensive Security Certified Professional

Tools

Magnet AXIOM Cyber

FTK

SleuthKit

Autopsy

Redline

Zeek

Suricata

Wireshark

tshark

NetFlow/IPFIX

JA3/JA3S

Microsoft Sentinel

Splunk

Microsoft Defender for Endpoint

Job description

FirstRand (RMB) is seeking a highly skilled Security Operations Centre Analyst III to lead incident response and digital forensics across host, network, and application layers. You will act as the SOC L3 bridge for escalations, threat hunts, and mentoring a talented team while advancing detection engineering and telemetry coverage.

Key duties include triage, evidence acquisition, and multi-source timelines with ATT&CK mapping.