Cyber Security SOC Engineer at Sasso Consulting in Johannesburg
Sasso Consulting · Johannesburg, Gauteng
Overview
Sasso Consulting is hiring 5 Cyber Security SOC Engineers in Johannesburg to build and run enterprise security monitoring. If you have 3 to 5 years of hands on SIEM, EDR/XDR and automation experience, this permanent role lets you work across Azure, AWS and hybrid environments while using MITRE ATT&CK to sharpen threat detection. It is a strong fit for engineers who want to specialise in detection engineering and security platform work, not just analyst shifts.
About the role
Sasso Consulting is recruiting 5 experienced Cyber Security SOC Engineers to design, implement, maintain and optimise enterprise security monitoring infrastructure. You will join a team that builds and runs the SOC platforms behind an organisation's threat detection capability.
What you can expect to do:
- Design, implement and maintain enterprise SOC infrastructure.
- Deploy, configure and administer SIEM platforms such as Microsoft Sentinel, Splunk, QRadar or Elastic Security.
- Develop security detection rules, correlation searches and monitoring dashboards.
- Integrate security logs from servers, endpoints, networks and cloud environments.
- Configure and maintain EDR/XDR security solutions.
- Develop SOAR automation workflows and incident response playbooks.
- Monitor and optimise SOC platform performance, availability and security.
- Troubleshoot security tool integrations and log ingestion issues.
- Improve threat detection capabilities using MITRE ATT&CK.
- Support security monitoring across Azure, AWS and hybrid environments.
Important: Candidates must demonstrate practical SOC engineering experience. SOC Analyst experience alone, without substantial security platform engineering responsibilities, will not be sufficient. There are 5 positions available and employment terms and benefits will be confirmed.
Requirements
- Relevant IT, Computer Science, Cybersecurity or Information Security qualification.
- 3 to 5 years hands on SOC engineering or SIEM engineering experience.
- Proven experience implementing and administering enterprise SIEM platforms.
- Strong knowledge of detection engineering, log management and security monitoring architecture.
- Practical experience with EDR/XDR technologies and SOAR automation.
- Scripting experience with Python, PowerShell, KQL or SPL.
- Knowledge of Windows Server, Linux, Active Directory and networking.
- Familiarity with cloud security monitoring and MITRE ATT&CK.
- Relevant certifications such as SC-200, Security+, CySA+, Splunk or QRadar advantageous.
- Must demonstrate practical SOC engineering experience; SOC Analyst experience alone will not be sufficient.
Responsibilities
- Design, implement and maintain enterprise SOC infrastructure.
- Deploy, configure and administer SIEM platforms such as Microsoft Sentinel, Splunk, QRadar or Elastic Security.
- Develop security detection rules, correlation searches and monitoring dashboards.
- Integrate security logs from servers, endpoints, networks and cloud environments.
- Configure and maintain EDR/XDR security solutions.
- Develop SOAR automation workflows and incident response playbooks.
- Monitor and optimise SOC platform performance, availability and security.
- Troubleshoot security tool integrations and log ingestion issues.
- Improve threat detection capabilities using MITRE ATT&CK.
- Support security monitoring across Azure, AWS and hybrid environments.
Benefits
Market related salary, dependent on experience and qualifications, 5 positions available, employment terms and benefits to be confirmed
Job details
- Organisation
- Sasso Consulting
- Location
- Johannesburg, Gauteng
- Job type
- Full time
- Experience level
- Mid (3+ years)
- Education
- Diploma
- Category
- IT & Software Development
- Application Method
- Apply online
Success Guide
If you are applying for this SOC Engineer role, make sure your CV does not just list SOC analyst duties. Sasso Consulting has been clear that they want practical engineering work, so highlight times you built detection rules, integrated log sources, configured SIEM or EDR platforms, or automated response playbooks. Mention your exact tools, like Microsoft Sentinel, Splunk, QRadar, Elastic Security and any SOAR or scripting experience with Python, PowerShell, KQL or SPL.
Certifications such as SC-200, Security+ or CySA+ will help you stand out, but your hands on stories matter most. Be ready to explain how you improved threat detection using MITRE ATT&CK and how you handled log ingestion problems. Save the listing link so you can apply on Pnet, and keep a copy of your CV and qualifications handy in case they ask for them.
How we help you prepare
This employer takes applications on their own website, so you'll submit this one yourself — but SPAAN NOW gets everything ready for you first. Here's how it works:
- Our AI tailors your CV to match this job's keywords and requirements, so it stands out to recruiters and screening systems.
- A custom cover letter is written specifically for this role — no generic templates.
- We gather the documents this job needs: CV and Diploma certificate. SPAAN NOW pulls these from your profile and packages them together, ready to attach.
- Once your application is prepared, we show you exactly how and where to apply — just follow the link to the employer and submit your ready-made CV, cover letter and documents.
- Mark it as applied under Applications to keep track, and if you're shortlisted, use AI Interview Prep to practise questions commonly asked for roles like this.
We do the hard part — tailoring and gathering everything — so applying yourself only takes a minute.
Spaan Talk
Nobody has said anything yet. Be the first.