Tier 2 Soc Analyst

Pro Q Consultancy ( Pty ) Ltd; Gauteng; On-site; ZAR 300 000 - 400 000; Full time

Job summary

A cybersecurity consultancy in South Africa is seeking a skilled Level 2 SOC Analyst to join their Security Operations Center. The role involves actively monitoring and responding to security incidents, conducting threat analysis, and mentoring junior analysts. Candidates should possess a degree in Information Security and relevant certifications. This position is on-site in Sandton and offers a contract employment type with market-related salary.

Qualifications

• Minimum of 2-3 years of experience in a SOC or cybersecurity role.
• Hands-on experience with various security tools.
• Proficiency in scripting to automate tasks.

Responsibilities

• Monitor and respond to escalated alerts and incidents.
• Perform in-depth analysis of security events.
• Lead incident investigations and document findings.

Skills

Cybersecurity best practices

Incident response methodologies

SIEM

Threat hunting

Scripting (Python, PowerShell)

Education

Bachelor's degree in Information Security or related field

Relevant certifications (e.g., CompTIA CySA+)

Tools

SIEM

EDR

IDS / IPS

Firewalls

Vulnerability management solutions

Job description

Job Summary We are looking for a skilled and detail-oriented Level 2 SOC Analyst to join our Security Operations Center (SOC) team.

This role is critical in defending against cyber threats by actively monitoring, analyzing, and responding to security incidents.

The Level 2 SOC Analyst will manage escalated alerts from Level 1, conduct in-depth threat analysis, and provide expert incident response to ensure the highest level of security for our clients' digital assets.

This position requires solid knowledge of cybersecurity best practices, incident response methodologies, and a thorough understanding of security technologies.

Key Responsibilities

• Monitor and respond to escalated alerts and incidents identified by Level 1 SOC Analysts.
• Perform in-depth analysis of security events using various security tools, such as SIEM, IDS / IPS, firewalls, and endpoint protection platforms.
• Correlate security events across multiple sources to assess potential impact and identify indicators of compromise (IOCs).
• Lead incident investigations, including containment, eradication, and recovery processes, following documented incident response procedures.
• Escalate incidents to Level 3 or SOC Manager if necessary, providing detailed analysis and recommendations.
• Document incidents, findings, and remediation actions thoroughly to support forensics, audit, and post-incident analysis.
• Conduct proactive threat hunting activities to detect potential threats and vulnerabilities.
• Analyze logs and network traffic to identify suspicious activity patterns.
• Work with the Vulnerability Management team to assess and mitigate vulnerabilities, applying patches, and updating signatures as needed.
• Collaborate with internal teams, including IT, infrastructure, and application security, to enhance security postures.
• Develop and present incident reports and threat analysis findings to senior team members, stakeholders, and management.
• Provide guidance and mentorship to Level 1 SOC Analysts, supporting their professional development.
• Review and refine SOC processes, playbooks, and incident response procedures to optimize efficiency.
• Stay current with emerging cybersecurity threats, trends, and technologies to improve SOC operations.
• Assist in training and upskilling SOC team members in advanced security analysis techniques.

Qualifications

• Bachelor's degree in Information Security, Cybersecurity, Computer Science, or related field preferred.
• Relevant certifications (e.g., CompTIA CySA+, GIAC Certified Incident Handler (GCIH), EC-Council Certified SOC Analyst (CSA), or similar) strongly preferred.
• Minimum of 2-3 years of experience in a SOC or cybersecurity role, with a focus on monitoring, analysis, and incident response.
• Hands‑on experience with security tools such as SIEM, EDR, IDS / IPS, firewalls, and vulnerability management solutions.
• Experience analyzing and responding to cybersecurity incidents, including malware analysis, threat hunting, and threat intelligence.
• Strong knowledge of network security principles, threat intelligence, and incident response processes.
• Proficiency in scripting (e.g., Python, PowerShell) and the ability to automate routine tasks.
• Understanding of MITRE ATT&CK framework, NIST Cybersecurity Framework, and other security standards.
• Excellent problem‑solving and analytical skills with keen attention to detail.
• Strong verbal and written communication skills, with the ability to explain complex security concepts to non‑technical stakeholders.
• Ability to work well under pressure, adapt quickly to changing priorities, and manage multiple incidents effectively.

Preferred Qualifications

• Experience working with cloud security tools and platforms (AWS, Azure, GCP).
• Knowledge of regulatory requirements and standards, such as GDPR, HIPAA, and ISO.
• Familiarity with threat intelligence platforms and the ability to correlate threat intelligence with SOC activities.

Location: Sandton, on-site role.

Salary: Market related.

Seniority level: Mid‑Senior level.

Employment type: Contract.

Job function: Information Technology.

Industries: Human Resources Services.