Cyber Security Threat Hunter | Johannesburg
Sasso Consulting · Johannesburg, Gauteng
Overview
Sasso Consulting is recruiting 5 experienced Cyber Security Threat Hunters to join their team in Johannesburg. This permanent, full-time role is perfect for cybersecurity professionals with 3 to 5 years of hands-on experience who want to proactively hunt sophisticated threats in a complex enterprise IT environment. You will work with cutting-edge security tools and the MITRE ATT&CK framework. If you have a passion for proactive defence, this is your opportunity.
About the role
Sasso Consulting is looking for 5 experienced Cyber Security Threat Hunters to join their team in Johannesburg. In this role, you will proactively identify, investigate and analyse sophisticated cyber threats within a complex enterprise IT environment.
You will be part of a team that goes beyond traditional security monitoring, actively hunting for threats that standard tools might miss. This is a permanent, full-time position based in Johannesburg.
Please note: Candidates must demonstrate actual proactive threat-hunting experience. Traditional SOC monitoring or alert-handling experience alone will not be sufficient for this role.
Requirements
- Relevant Diploma or Degree in IT, Computer Science, Cybersecurity, Information Security or a related field
- 3 to 5 years of relevant hands-on cybersecurity experience, including practical threat hunting or advanced security investigations
- Proven experience conducting proactive, hypothesis-driven threat hunting within enterprise environments
- Strong practical experience with SIEM platforms such as Microsoft Sentinel, Splunk or IBM QRadar
- Hands-on experience with EDR/XDR solutions such as Microsoft Defender, CrowdStrike or SentinelOne
- Strong understanding of MITRE ATT&CK, threat intelligence and attacker techniques
- Experience analysing security logs, endpoint telemetry and network traffic
- Knowledge of Active Directory, Windows, Linux and cloud security
- Experience with KQL, SPL, PowerShell or Python
- Strong analytical, investigative and problem-solving abilities
- Advantageous certifications: CompTIA Security+ / CySA+, Microsoft SC-200, GIAC GCIH / GCIA / GCFA, CISSP / CEH, or relevant threat-hunting or digital forensics certifications
Responsibilities
- Conduct proactive threat-hunting investigations across enterprise networks, endpoints, servers and cloud environments
- Develop and execute threat-hunting hypotheses using threat intelligence and attacker behaviour
- Analyse SIEM, EDR and XDR security data to identify suspicious activities and potential compromises
- Investigate advanced persistent threats, credential compromise, lateral movement and privilege escalation
- Identify indicators of compromise (IOCs) and attacker tactics, techniques and procedures (TTPs)
- Apply the MITRE ATT&CK framework during investigations
- Analyse endpoint, network, identity and cloud security logs
- Investigate suspicious activity across Windows, Linux, Active Directory and cloud environments
- Identify security monitoring gaps and recommend improvements to detection capabilities
- Collaborate with SOC analysts, incident response teams and security engineers
- Prepare detailed threat-hunting reports and investigation findings
Job details
- Organisation
- Sasso Consulting
- Location
- Johannesburg, Gauteng
- Job type
- Full time
- Experience level
- Mid (3+ years)
- Education
- Diploma
- Category
- IT & Software Development
- Application Method
- Apply online
Success Guide
This is a great opportunity for a cybersecurity professional with a few years of experience who is ready to specialise in threat hunting. Sasso Consulting is looking for 5 people, so your chances are better than usual. Make sure your CV clearly shows hands-on threat hunting work, not just SOC monitoring. Mention specific tools you have used and any threat hunting hypotheses you have developed. Certifications like Security+, CySA+ or SC-200 will help you stand out. The role is based in Johannesburg, so you will need to be able to work on site. Good luck!
How we help you prepare
This employer takes applications on their own website, so you'll submit this one yourself — but SPAAN NOW gets everything ready for you first. Here's how it works:
- Our AI tailors your CV to match this job's keywords and requirements, so it stands out to recruiters and screening systems.
- A custom cover letter is written specifically for this role — no generic templates.
- We gather the documents this job needs: CV, Diploma certificate and Degree certificate. SPAAN NOW pulls these from your profile and packages them together, ready to attach.
- Once your application is prepared, we show you exactly how and where to apply — just follow the link to the employer and submit your ready-made CV, cover letter and documents.
- Mark it as applied under Applications to keep track, and if you're shortlisted, use AI Interview Prep to practise questions commonly asked for roles like this.
We do the hard part — tailoring and gathering everything — so applying yourself only takes a minute.
Spaan Talk
Nobody has said anything yet. Be the first.