Technical Lead – SOC Cyber Defense (iOCO0083)

Job Description What you'll do:

• Define and execute a structured hypothesis-driven threat hunting programme aligned to MITRE ATT&CK TTPs relevant to client industries.
• Oversee a hunt cadence weekly/monthly with documented hypotheses, datasets queried, findings, and new detections produced.
• Track hunt effectiveness metrics: hunts executed, TTPs covered, detections created, threats uncovered, dwell time reduction.
• Drive proactive identification of stealthy, low-signal threats LOLBins, identity abuse, persistence, lateral movement.
• Ensure hunt outcomes feed back into detection engineering, playbooks, and threat intel for continuous improvement.
• Govern the detection lifecycle - ideation, development, testing, deployment, tuning, retirement.
• Reviewing versioned detection library LQL - Logpoint Query Language mapped to MITRE ATT&CK with coverage scoring.
• Drive measurable improvement in detection coverage % per tactic/technique, per client environment.
• Drive the Reduction in false positives and alert fatigue signal-to-noise ratio, precision/recall metrics per rule.
• Ensure detections are tested via purple team / atomic red team / BAS tools before production release.
• Review detection-as-code practices Python
• Oversee L1/L2 analyst quality depth of investigation, accuracy of triage, and quality of incident write-ups.
• Govern incident analysis standards timelines, IOC pivoting, scope determination, attribution where relevant.
• Ensure root cause analysis RCA and lessons learned are captured and converted into preventative controls.
• Work with SOC OPS Manager to Maintain playbooks for top threat scenarios ransomware, BEC, identity compromise, data exfiltration.
• Drive analyst skill uplift through case reviews, mentoring, and structured training paths.
• Operate a structured CTI capability across strategic, operational, and tactical levels.
• Track threat actor groups, campaigns, and TTPs relevant to the organisation and client base.
• Ensure CTI informs risk decisions, vulnerability prioritisation, and board reporting.
• Monitor geopolitical, regulatory, and industry events that may translate into cyber risk POPIA, sanctions, hacktivism.
• Track exposure to active campaigns and trigger proactive defensive actions.
• Maintain real-time situational awareness of the threat landscape – global, regional Africa/SA, and sector-specific.
• Maintain transparent metrics on detection coverage, hunt outcomes, intel value, and research impact.
• Provide daily/weekly intel briefings to SOC Manager
• Govern effective use of GuardSix, EDR WithSecure, email security Mimecast, Zscaler, and supporting platforms for detection and hunting.
• Ensure log source coverage and data quality required for hunting and analytics
• Review KOUEBA, identity analytics, and behavioural detections beyond signature-based controls. Align with L3
• Maintain audit-ready documentation: hunt records, detection change logs, intel reports, research artefacts.
• Ensure ethical handling of intel, OSINT, and research legal, privacy, and disclosure boundaries respected.
• Contribute to enterprise risk register with threat-informed risk inputs.
• Manage and grow a multi-disciplinary team hunters, detection engineers, analysts, intel analysts, researchers.
• Participate/Facilitate internal purple team exercises, CTFs, and tabletop scenarios to build muscle memory.
• Contribute to threat-informed reporting to CISO, exec, and clients not just volumes, but business-relevant insight.
• Translate technical threat data into business risk language impact, likelihood, exposure, recommended action.
• Provide quarterly threat landscape and defensive posture reviews to leadership and key clients.
• Partner closely with SOC Operations Manager feed detections/playbooks, Exposure and Vulnerability Management intel-led prioritisation, IR threat context, and GRC risk inputs.
• Engage with client CISOs and security teams on threat briefings and joint exercises.
• Drive measurable year-on-year improvement in detection coverage, hunt yield, and intel-driven outcomes.

Your Expertise

• 8–12+ years' experience in Cybersecurity Operations.
• 5+ years' experience in Threat Hunting, Detection Engineering, Threat Intelligence, Incident Response, or Advanced SOC Operations.
• Proven experience leading Threat Hunting, Detection Engineering, CTI, and SOC Analysis teams.
• Experience operating within enterprise or MSSP security environments.
• Experience building and managing detection programs mapped to MITRE ATT&CK.
• Experience developing and tuning SIEM detection use cases.

Experience performing advanced threat investigations involving

• Identity compromise
• Ransomware
• Business Email Compromise BEC
• Data exfiltration
• Insider threats
• Cloud attacks
• Lateral movement
• LOLBins and living-off-the-land techniques
• Experience presenting threat intelligence and security risks to executive leadership and clients.
• Experience managing threat-informed security programs and continuous improvement initiatives.

Qualifications: Qualification Essential Competency Strong practical experience with:

• SIEM Platforms e.g Logpoint, Sentinel, Splunk, QRadar, ArcSight
• EDR/XDR Platforms e.g. WithSecure, CrowdStrike, Defender, SentinelOne
• SOAR Platforms
• Vulnerability Management Platforms
• Identity Security Solutions
• UEBA Platforms
• Cloud Security Controls
• Threat Intelligence Platforms TIP
• MITRE ATT&CK
• CIS/NIST Cyber Security Framework
• Cyber Threat Intelligence Lifecycle
• Detection Engineering Frameworks
• Threat Modelling

Qualifications preferred/ knowledge

• CTIA Certified Threat Intelligence Analyst
• CREST CRT
• CREST CCTIM