Senior SOC Threat Hunting & Detection Lead

iOCO; Gauteng; On-site; ZAR 1,000,000 - 1,500,000; Full time

Job summary

iOCO in Johannesburg is seeking a senior Cyber Security professional to lead a threat hunting program aligned to MITRE ATT&CK, working with SIEMs, EDR, and threat intel to reduce dwell time and improve detection coverage.

You will mentor analysts, drive purple-team exercises, and ensure risk-informed decisions are communicated to leadership and clients.

This permanent role offers continuous learning and opportunities to influence security across industries.

Qualifications

• 8–12+ years' experience in Cybersecurity Operations.
• 5+ years' experience in Threat Hunting, Detection Engineering, Threat Intelligence, Incident Response, or Advanced SOC Operations.
• Proven experience leading Threat Hunting, Detection Engineering, CTI, and SOC Analysis teams.
• Experience building and managing detection programs mapped to MITRE ATT&CK.
• Experience developing and tuning SIEM detection use cases.

Responsibilities

• Define and execute a structured hypothesis-driven threat hunting programme aligned to MITRE ATTACK TTPs for client industries.
• Oversee a hunt cadence with documented hypotheses, datasets queried, findings, and new detections produced.
• Track hunt effectiveness metrics: hunts executed, TTPs covered, detections created, threats uncovered, dwell time reduction.
• Drive proactive identification of stealthy threats (LOLBins, identity abuse, persistence, lateral movement).
• Ensure hunt outcomes feed back into detection engineering, playbooks, and threat intel for continuous improvement.
• Govern the detection lifecycle - ideation, development, testing, deployment, tuning, retirement.

Skills

Threat Hunting

Detection Engineering

Threat Intelligence

Incident Response

SOC Operations

MITRE ATT&CK

SIEM

EDR/XDR

Leadership

Executive Communication

Education

CTIA

CREST CRT

CREST CCTIM

Tools

Logpoint SIEM

Microsoft Sentinel

Splunk

QRadar

ArcSight

WithSecure EDR

CrowdStrike

Microsoft Defender

SentinelOne

SOAR Platforms

Vulnerability Management

Identity Security

UEBA

Cloud Security

TIP

MITRE ATT&CK

Job description

iOCO in Johannesburg is seeking a senior Cyber Security professional to lead a threat hunting program aligned to MITRE ATT&CK, working with SIEMs, EDR, and threat intel to reduce dwell time and improve detection coverage.

You will mentor analysts, drive purple-team exercises, and ensure risk-informed decisions are communicated to leadership and clients.

This permanent role offers continuous learning and opportunities to influence security across industries.