Senior SOC Analyst: Incident Response & Forensics Leader

FirstRand Limited; Randburg; On-site; ZAR 800,000 - 1,200,000; Full time

Job summary

FirstRand Limited is seeking a Senior SOC Analyst to lead end-to-end incident response and digital forensics across host, network, and application layers. You will function as the SOC L3, owning escalations, threat hunts, and detection engineering while mentoring junior staff.

The role requires expert log analysis across Windows/Linux/macOS, proficiency with PCAP, SIEM/EDR tools, and scripting for automation. A strong foundation in ATT&CK mapping and forensics is essential.

Qualifications

• Experience in end-to-end incident response and digital forensics across host, network, and application layers.
• Proficient in PCAP analysis, Zeek, NetFlow/IPFIX, TLS/DNS telemetry, and SIEM/EDR tooling.
• Scripting for data parsing and automation (PowerShell, Python) and ATT&CK mapping knowledge.

Responsibilities

• Lead incident response and forensics triage, define hypotheses and investigative plans.
• Acquire volatile and non-volatile evidence with chain-of-custody.
• Analyze web/server logs, detect web app vulnerabilities and indicators of compromise.
• Research and validate detections; craft remediation guidance and validation testing.
• Mentor and collaborate with SOC teams; develop and tune SIEM/EDR analytics.

Job description

FirstRand Limited is seeking a Senior SOC Analyst to lead end-to-end incident response and digital forensics across host, network, and application layers. You will function as the SOC L3, owning escalations, threat hunts, and detection engineering while mentoring junior staff.

The role requires expert log analysis across Windows/Linux/macOS, proficiency with PCAP, SIEM/EDR tools, and scripting for automation. A strong foundation in ATT&CK mapping and forensics is essential.