SOC Analyst

EG5 Special Risks Consultancy; Cape Town; Hybrid; ZAR 350,000 - 650,000; Full time

Benefits offered by this job

Holiday – 23 days per year increasing

Life insurance – 4x annual salary

Private pension – up to 7%

Headspace mindfulness app

Hybrid working and flexible hours

Medical and dental benefits

Job summary

S-RM in Cape Town is seeking a SOC Analyst to join our Cyber Security division. You will deliver security operations across managed detection and response services, using SIEM, SOAR, and EDR tools. The role is hybrid with two days in the office and supporting a 24/7 shift rotation.

The ideal candidate has 2–3 years in a SOC, experience with Windows and Linux, AD, and M365 security monitoring, and a proactive mindset. This is a dynamic team focused on learning and growth.

Qualifications

• 2–3 years of experience working within a Security Operations Centre (SOC)
• Proficient in XDR and SIEM platforms (e.g., SentinelOne Singularity, Microsoft Sentinel)
• Experience with EDR solutions (SentinelOne, Defender for Endpoint, CrowdStrike)
• Knowledge of alert triage, event correlation, threat investigation, and incident escalation
• Working knowledge of Windows and Linux, Active Directory, and Microsoft 365 security monitoring
• Experience maintaining incident records, investigation notes, and operational documentation

Responsibilities

• Monitor security events from EDR, SIEM, and other tools to detect threats
• Conduct investigations and respond to incidents with containment, mitigation, and remediation
• Threat hunting to identify IoCs and advanced threats
• Tune detection rules, automate workflows, and improve incident detection
• Perform in-depth log analysis from firewalls and endpoints
• Collaborate with threat intelligence to enhance detection
• Document incidents, responses, and resolutions
• Participate in a 24/7 shift rotation including evenings, nights, and weekends

Skills

SOC operations

Incident response

Threat hunting

Threat detection

Log analysis

Threat intelligence

Documentation

Communication

Education

Bachelor’s degree in cyber security, Information Security, Computer Science, or related discipline

CompTIA CySA+

SC-100/SC-200

GIAC Certified Incident Handler (GCIH)

Certified SOC Analyst (CSA)

Blue Team / SOC Level 1 or 2

Tools

SIEM

SOAR

EDR

XDR

Job description

SOC Analyst

We have a new and exciting SOC Analyst role available within our Cyber Security division in Cape Town.

Who we are

S-RM is a global intelligence and cyber security consultancy. Since 2005, we’ve helped some of the most demanding clients in the world solve some of their toughest information security challenges.

We’ve been able to do this because of our outstanding people. We’re committed to developing sharp, curious, driven individuals who want to think critically, solve complex problems, and achieve success.

But we also know that work isn’t everything. It’s about the lives and careers it helps us build. We’re immensely proud of this culture and we invest in our people’s wellbeing, learning, and ideas every day.

We’re excited you’re thinking about joining us.

Working in Cyber at S-RM

Our Cyber Security division is the fastest-growing part of S-RM. The cyber sector is always evolving, and our Managed Services, Advisory, and Incident Response practices are in more demand than ever.

We’re building a team to meet this challenge. We’re quick to respond, innovate, and improve. We don’t get too hung up on hierarchy or bureaucracy. If your ideas are good enough, we’ll empower you to implement them. If you’re the best person to talk to a customer, you’ll get that opportunity, regardless of the title in your email signature. And when you need a hand, your team will always have your back.

We also don’t believe there’s a typical cyber security professional. We’ve built a team of intelligence analysts, technical specialists, software developers, investigators, risk managers, and more. You’ll always find a range of perspectives and expertise to help you learn and grow.

If that sounds like your kind of team, we’d like to hear from you.

The role

As a SOC Analyst you will deploy your cybersecurity expertise in a vital delivery role across our managed detection and response services.

In this role, you will use infrastructure and tools that power our Security Operations Centre (SOC) to deliver desired security outcomes for our managed services clients. The ideal candidate will have familiarity with security tools such as SIEM, SOAR, EDR, and other advanced technology. You will have a proven ability to respond effectively to security incidents. This hybrid role involves both remote work and some in-office presence for collaboration, teamwork and development.

• Monitor Security Events: Continuously monitor and analyse security alerts from EDR, SIEM and other security tools to detect suspicious activities or potential threats.
• Incident Response: Conduct investigations and respond to security incidents, executing containment, mitigation, and remediation steps as necessary.
• Threat Hunting: Proactively search for indicators of compromise (IoCs) and advanced threats within the environment, utilising both automated tools and manual analysis.
• Threat Detection: Use expertise to tune detection rules, automate workflows, and improve incident detection accuracy.
• Log Analysis: Perform in-depth log analysis from firewalls, endpoint protection platforms, and other solutions to investigate complex incidents.
• Threat Intelligence: Stay informed of emerging threats and collaborate with the threat intelligence team to enhance detection capabilities.
• Incident Reporting and Documentation: Ensure detailed documentation of incidents, responses, and resolutions to maintain a clear incident management process.
• Shift Work: Participate in a 24/7 shift rotation to ensure continuous security monitoring, including evening, night, and weekend shifts.

The role will be based in our Cape Town office and is hybrid with a minimum of two days a week in office.

What we are looking for

The ideal candidate will have 2 to 3 years of experience working within a Security Operations Centre (SOC), with proven hands‑on experience monitoring, investigating, and responding to security alerts and incidents.

They should be proficient in the use of XDR and SIEM platforms such as SentinelOne Singularity or Microsoft Sentinel, as well as Endpoint Detection and Response (EDR) solutions including SentinelOne, Microsoft Defender for Endpoint, or CrowdStrike.

The role requires experience in alert triage, event correlation, threat investigation, and incident escalation, supported by a solid understanding of common cyber threats, attack techniques, and security frameworks.

Candidates should also have working knowledge of Windows and Linux operating systems, Active Directory, and Microsoft 365 security monitoring, together with experience maintaining incident records, investigation notes, and operational documentation.

Minimum Qualifications And Experience

• Bachelor’s degree in cyber security, Information Security, Computer Science, or related discipline.
• Additional certifications such as:
• CompTIA CySA+
• SC-100/SC-200
• GIAC Certified Incident Handler (GCIH)
• Certified SOC Analyst (CSA)
• Blue Team / SOC Level 1 or 2 (CyberDefenders or THM)

Preferred Qualifications And Experience

• Experience with Security Orchestration, Automation and Response (SOAR) platforms.
• Exposure to cloud security monitoring, particularly Microsoft Azure and Microsoft 365.
• Previous experience supporting managed security services (MSSP/MDR) environments or multiple clients
• Experience developing detection rules, SIEM use cases, and security playbooks
• Knowledge of threat intelligence feeds and MITRE ATT&CK framework mapping

Successful candidates are also likely to show the following skills and competencies

• Strong analytical and critical thinking skills
• Attention to detail and accuracy
• Effective decision‑making under pressure
• Strong verbal and written communication skills
• Ability to work independently and within a team environment
• Time management and prioritisation skills
• Continuous learning mindset and adaptability
• Customer service and stakeholder engagement skills
• Professional integrity and confidentiality
• Ability to work shifts and participate in on‑call rotations when required
• Strong organisational and investigative skills

Resilience and the ability to perform in a fast‑paced operational environment

The successful candidate must have permission to work in South Africaby the start of their employment.

Our benefits

• Holiday – 23 days per year increasing to 28 days (+1 day for every year you worked at S-RM, up to a maximum of 5 days) in addition to bank holidays
• Gap Cover policy – allowing you to bridge the gap between your medical bills and your medical aid cover.
• Life insurance – 4x annual salary
• Private pension – up to 7% contribution matched by the company
• Formalised Recognition programme
• Hybrid working and flexible working hours

Parental Support

• Fertility treatment leave – 5 days of leave per cycle of treatment per year
• Maternity leave – 26 weeks of full pay followed by 13 weeks of half pay (after 1 year at the company on the "qualifying week" = 15 weeks before a due date)
• Paternity leave – 6 weeks of full pay (after 1 year at the company on the "qualifying week" = 15 weeks before a due date)

Various Health And Medical Benefits Including

• Medical aid with Discovery Health for employee, partner, and children up to the cost of the Classic Saver plan (taxable benefit) for you and your family;
• EAP (Employee Assistance Programme) for employees and immediate family, including counselling sessions
• Free access to the world‑famous mindfulness app Headspace.
• Seasonal flu vaccination
• Eye tests and glasses reimbursement up to certain cost on an annual basis