SOC Engineer

360 Smart Networks

Stellenbosch

On-site

ZAR 600,000 - 900,000

Full time

4 days ago

Be an early applicant

A complete application in a minute

Tailored resume and cover letter, ready to send.

Get past ATS filters

Job summary

360 Smart Networks is seeking a Security Engineer to join our South African team, focusing on incident response, threat analysis, vulnerability management, and security operations across client environments. You will work with CrowdStrike, Petra, Blumira, and broader security stacks to improve detection, containment, and remediation.

The role emphasizes operational response, documentation, and continuous improvement within a fast-paced MSP/multi-client setting, with non-negotiable working hours

Qualifications

3 to 5 years in Security Operations/Incident Response
Experience in MSP/MSSP or multi-client environments preferred
Hands-on with CrowdStrike Falcon
Vulnerability management and threat analysis experience
Able to write incident summaries and after-action reports

Responsibilities

Monitor network traffic, alerts, endpoints, and logs for suspicious activity
Investigate, contain, and respond to incidents with clear notes and remediation
Support security operations across CrowdStrike, Petra, Blumira
Conduct vulnerability assessments and remediation tracking
Lead or contribute to incident response and root cause analysis
Maintain accurate incident notes, playbooks, SOPs, and security docs
Collaborate with engineers, vendors, and leadership for service quality

Skills

Security Operations

Incident Response

Vulnerability Management

Threat Analysis

Documentation

Education

CompTIA Security+ (or equivalent)

CompTIA CySA+ (or equivalent)

ISC2 SSCP (or equivalent)

Tools

CrowdStrike Falcon

Blumira

Petra

Microsoft 365

Azure

Microsoft Entra ID

Purview

ConnectWise

SIEM

Job description

360 Smart Networks is hiring a Security Engineer to join our South African team. This role suits a strong security-focused troubleshooter who thrives in a fast-paced MSP / multi-client environment and wants to deepen their skills across incident response, security monitoring, threat analysis, vulnerability management, and modern security operations.

The role focus is on monitoring, investigating suspicious activity, responding to security incidents, conducting vulnerability assessments, and improving internal security processes and documentation.

You’ll work with a global support and operations team, handling security escalations, incident investigations, proactive threat detection, and remediation across client environments, while contributing to secure, scalable, and well-documented security operations. SOC/security engineer roles in South Africa commonly emphasize operational response, tooling, reporting, and continuous improvement in exactly this type of environment.

What You’ll Do (Key Responsibilities but not limited to)

Monitor and analyse network traffic, security alerts, endpoint activity, and logs for suspicious or malicious behaviour.
Investigate, contain, and respond to security incidents and breaches, with clear notes, escalation, remediation, and follow-through to resolution.
Support and improve security operations across CrowdStrike, Petra, Blumira, and broader medium enterprise security stacks.
Conduct threat analysis, IOC review, vulnerability assessments, and remediation tracking across endpoints, users, cloud, and infrastructure.
Lead or contribute to incident response, root cause analysis, after-action reporting, and lessons learned sessions.
Perform risk analysis and security reviews to assess the effectiveness of controls and identify security gaps.
Maintain accurate documentation: incident notes, playbooks, SOPs, environment security notes, and remediation records.
Collaborate with engineers, vendors, and leadership while contributing to service quality through continuous improvement.

Working Hours (Non-Negotiable):

15:00 – 00:00 (midnight) for half the year, then 16:00 – 01:00 for the other half.

Highly beneficial work habits

Strong incident ownership with calm, accurate decision-making under pressure.
Clean documentation, strong reporting discipline, and consistent security ticket hygiene.
Proactive identification of risks, attack paths, recurring threats, and control weaknesses.
Confident escalation handling and follow-through from detection to remediation.

Candidate Requirements

Technical Core (Highly beneficial but not limited to)

Working capability across Microsoft 365, Azure, Microsoft Entra ID, Purview and Microsoft security tooling.
Hands-on experience with CrowdStrike, Petra, Blumira, or equivalent systems and broader security stacks used in medium enterprise environments.
Solid understanding of network security fundamentals, including traffic analysis, suspicious behaviour detection, and investigation workflow.
Strong capability in vulnerability assessments, remediation tracking, and risk reduction.
Good understanding of identity-driven security and conditional access in Microsoft environments, including authentication, authorization, governance, and Zero Trust controls.
Ability to write clear incident summaries, after-action reports, and internal documentation.
Comfortable working independently while collaborating with support, infrastructure, and leadership teams.

Mandatory work experience

Security Operations / Incident Response: 3 to 5 years
Vulnerability Management / Threat Analysis: 3 to 5 years
Security Tooling / SIEM / Endpoint Security: 3 to 5 years
MSP / Multi-client security support: Preferred and highly beneficial
Security Operations / SOC / Incident Response: 4 years (Preferred)
vulnerability management or threat analysis: 4 years (Preferred)
working in an MSP, MSSP, or multi-client support environment: 4 years (Preferred)
CrowdStrike Falcon: 1 year (Preferred)
Blumira: 1 year (Preferred)
Petra: 1 year (Preferred)
Microsoft Entra ID: 1 year (Preferred)
ConnectWise: 1 year (Preferred)
Security, or security alert investigation: 4 years (Preferred)