Soc Technical Specialist — Intermediate

Redherd.Io; Johannesburg; On-site; ZAR 600,000 - 900,000; Full time

Benefits offered by this job

Flexible hours

Travel to client sites

Structured training & certification

On-site work in Johannesburg

Job summary

RedHerd is seeking a SOC Technical Specialist in Johannesburg, offering a hybrid of hands-on security engineering and SOC operations. The role combines investigating and hunting threats with deploying and maintaining Elastic and Wazuh platforms for multiple client environments.

The position is office-based with flexible hours and travel to client sites. Ideal candidates have 2+ years in SOC, strong SIEM experience, and good communication skills in English.

Qualifications

• Two+ years in a SOC, security monitoring or related technical security role.
• Hands-on operational experience with Elastic and Wazuh in production.
• Linux and Windows administration.
• Clear written English for notes/reports.
• Willingness to travel for client installations.

Responsibilities

• Monitor and triage security alerts, events and cases across client environments.
• Investigate suspicious activity using endpoint, network, identity, and application telemetry.
• Deploy, configure and maintain Elastic- and Wazuh-based SOC installations.
• Onboard log sources and parse, normalise telemetry.
• Build dashboards, alerts, and detection rules tuned to reduce noise.
• Support client installations remotely and on site.
• Write investigation notes, incident timelines, and client-facing reports.

Skills

Elastic

Wazuh

Linux

Windows

SOC monitoring

Threat hunting

Tools

Kibana

Logstash

Elastic Agent

Job description

SOC Technical Specialist

Location: Johannesburg, South Africa
Employment type: Full-time, permanent
Seniority: Intermediate to senior, two years or more in a SOC or technical security role

At a glance

• Half analyst, half engineer. You investigate and hunt across client environments, and you also build and maintain the Elastic and Wazuh platforms that monitor them.
• Hands-on Elastic and Wazuh experience & Linux and Windows administration.
• Office-based with flexible hours, plus travel to client sites for installations and support.

About RedHerd

RedHerd is a specialist cybersecurity recruitment and advisory firm. We work with consultancies, product companies, vendors and enterprise security teams across South Africa, the UK, Europe and the United States. We are recruiting this position exclusively on behalf of our client. We share their identity with you during qualification, before submitting anything. We never introduce your profile without your knowledge and consent.

About the client

Our client is an established cybersecurity consultancy that delivers offensive security and managed security services to organisations across Southern Africa and beyond. Its client base includes businesses in Portuguese- and French-speaking markets.

The SOC runs on Elastic and Wazuh, and the team deploys and supports those platforms inside client environments as well as monitoring through them.

The role

This seat combines day-to-day SOC work with the engineering that makes the SOC possible. On one side, you monitor, investigate and hunt. On the other, you deploy agents, onboard log sources, tune detections and keep the platforms healthy across client installations.

It suits someone with solid SOC fundamentals who likes working with the technology as much as the alerts. You will work alongside consultants, infrastructure teams and client stakeholders to fix technical problems and widen security visibility.

What it is not. It is not a pure alert-monitoring seat, and it is not a back-office platform job either. You need to be comfortable doing both halves. It is not a people-management position.

What you will do

• Monitor and triage security alerts, events and cases across client environments.
• Investigate suspicious activity using endpoint, network, identity, and application telemetry, and decide what is a real threat and what is a false positive.
• Escalate confirmed and high-risk incidents, and support initial analysis, evidence collection, scoping and containment under approved procedures.
• Run hypothesis-led threat hunts, mapping findings to MITRE ATT&CK.
• Deploy, configure and maintain Elastic- and Wazuh-based SOC installations, including Wazuh agents and Elastic data-collection components on Windows and Linux.
• Onboard log sources, then parse, normalise and validate them so the right telemetry actually arrives.
• Build and maintain dashboards, alerts, detection rules, decoders and integrations, and tune them to cut noise without hiding real threats.
• Watch platform health: ingestion, agent connectivity, storage, performance and data availability.
• Handle upgrades, configuration changes, backups and testing, and troubleshoot across applications, operating systems, networks, certificates, permissions and data pipelines.
• Support client installations remotely and on site.
• Write investigation notes, incident timelines, client-facing reports and system documentation, and help improve SOC playbooks and procedures.

What you must bring

At least two years in a SOC, security monitoring, security engineering or closely related technical security role. Treat that as a level, not a ceiling.

• Hands-on operational experience with both Elastic and Wazuh, in production, client or comparable lab environments.
• Working knowledge of the Elastic Stack: Elasticsearch, Kibana and ingestion through Elastic Agent, Beats or Logstash.
• Working knowledge of Wazuh: agent management, rules, decoders, alerting and troubleshooting.
• Real experience investigating alerts and security events in a SIEM or security analytics platform.
• Confident administration and troubleshooting on both Linux and Windows.
• A sound grasp of Windows event logs, Linux system and authentication logs, and endpoint telemetry.
• Networking fundamentals: TCP/IP, DNS, HTTP/S, firewalls, proxies and common network services.
• The ability to read raw logs and correlate events across sources.
• Clear written English for investigation notes and reports.
• Willingness and ability to travel for client installations and support.
• Legal eligibility to work in South Africa.

Useful extras

• Portuguese or French. The client serves businesses in Portuguese- and French-speaking markets.
• Writing or tuning detections in KQL, Lucene, EQL, Sigma or similar formats.
• Integrating firewalls, endpoint tools, identity platforms, cloud services and threat-intelligence feeds with a SIEM.
• Fleet, Elastic Security, Wazuh Indexer, Wazuh Dashboard or clustered deployments.
• Scripting in Python, PowerShell or Bash.
• Incident response, digital forensics, malware triage or vulnerability management exposure.
• Multi-client or managed security service experience, and ticketing or case-management processes.
• Certifications such as Security+, CySA+, Blue Team Level 1, Elastic certifications, SC-200 or GIAC.
• A tertiary qualification in IT, computer science, cybersecurity or a related field.

Work arrangement

Johannesburg. Primarily office-based, with flexible working hours.

Travel is required for client installations and support. Onboarding and configuration work happens on site with clients.

Package and development

We will discuss the package during the Clearing Call with RedHerd.

• Company-provided devices and the professional tooling the role needs.
• A structured training and certification path.
• Company-supported learning, lab access and certification exams.
• Exposure to varied client environments, building both analysis and SOC-engineering skills.

If a profile or CV does not fully describe confidential work, candidates are encouraged to explain their contribution without disclosing sensitive customer or employer information.

Why this role

• You grow as an analyst and as a SOC engineer at the same time.
• Real platform ownership across Elastic and Wazuh, not just a login to someone else's SIEM.
• Varied client environments rather than one estate.
• A structured training and certification path, with exams and lab access paid for.
• Company-provided devices and tooling.

Equal opportunity

Applications are considered against the skills, experience, location and verification requirements of the role. RedHerd and our clients are committed to a fair and respectful process and do not discriminate on the basis of any protected characteristic.