SOC Engineer

360 Smart Networks is hiring a Security Engineer to join our South African team. This role suits a strong security-focused troubleshooter who thrives in a fast-paced MSP / multi-client environment and wants to deepen their skills across incident response, security monitoring, threat analysis, vulnerability management, and modern security operations.

The role focus is on monitoring, investigating suspicious activity, responding to security incidents, conducting vulnerability assessments, and improving internal security processes and documentation.

You’ll work with a global support and operations team, handling security escalations, incident investigations, proactive threat detection, and remediation across client environments, while contributing to secure, scalable, and well-documented security operations. SOC/security engineer roles in South Africa commonly emphasize operational response, tooling, reporting, and continuous improvement in exactly this type of environment.

What You’ll Do (Key Responsibilities but not limited to)

• Monitor and analyse network traffic, security alerts, endpoint activity, and logs for suspicious or malicious behaviour.
• Investigate, contain, and respond to security incidents and breaches, with clear notes, escalation, remediation, and follow-through to resolution.
• Support and improve security operations across CrowdStrike, Petra, Blumira, and broader medium enterprise security stacks.
• Conduct threat analysis, IOC review, vulnerability assessments, and remediation tracking across endpoints, users, cloud, and infrastructure.
• Lead or contribute to incident response, root cause analysis, after-action reporting, and lessons learned sessions.
• Perform risk analysis and security reviews to assess the effectiveness of controls and identify security gaps.
• Maintain accurate documentation: incident notes, playbooks, SOPs, environment security notes, and remediation records.
• Collaborate with engineers, vendors, and leadership while contributing to service quality through continuous improvement.

Working Hours (Non-Negotiable):

15:00 – 00:00 (midnight) for half the year, then 16:00 – 01:00 for the other half.

Highly beneficial work habits

• Strong incident ownership with calm, accurate decision-making under pressure.
• Clean documentation, strong reporting discipline, and consistent security ticket hygiene.
• Proactive identification of risks, attack paths, recurring threats, and control weaknesses.
• Confident escalation handling and follow-through from detection to remediation.

Candidate Requirements

Technical Core (Highly beneficial but not limited to)

• Working capability across Microsoft 365, Azure, Microsoft Entra ID, Purview and Microsoft security tooling.
• Hands-on experience with CrowdStrike, Petra, Blumira, or equivalent systems and broader security stacks used in medium enterprise environments.
• Solid understanding of network security fundamentals, including traffic analysis, suspicious behaviour detection, and investigation workflow.
• Strong capability in vulnerability assessments, remediation tracking, and risk reduction.
• Good understanding of identity-driven security and conditional access in Microsoft environments, including authentication, authorization, governance, and Zero Trust controls.
• Ability to write clear incident summaries, after-action reports, and internal documentation.
• Comfortable working independently while collaborating with support, infrastructure, and leadership teams.

Mandatory work experience

• Security Operations / Incident Response: 3 to 5 years
• Vulnerability Management / Threat Analysis: 3 to 5 years
• Security Tooling / SIEM / Endpoint Security: 3 to 5 years
• MSP / Multi-client security support: Preferred and highly beneficial
• Security Operations / SOC / Incident Response: 4 years (Preferred)
• vulnerability management or threat analysis: 4 years (Preferred)
• working in an MSP, MSSP, or multi-client support environment: 4 years (Preferred)
• CrowdStrike Falcon: 1 year (Preferred)
• Blumira: 1 year (Preferred)
• Petra: 1 year (Preferred)
• Microsoft Entra ID: 1 year (Preferred)
• ConnectWise: 1 year (Preferred)
• Security, or security alert investigation: 4 years (Preferred)

Certifications
The following certifications are highly preferred, but not limited to:

• CompTIA Security+ (or equivalent)
• CompTIA CySA+ (or equivalent)
• ISC2 SSCP (or equivalent)

Microsoft role-based certs preferred, but not limited to

• SC-200 (Security Operations Analyst)
• SC-300 (Identity and Access Administrator)
• AZ-900 / AZ-104

Other relevant security, SIEM, cloud, incident response, or CrowdStrike Falcon administrator.