Department: Security Operations & 24/7 Support TeamReporting To: Service Delivery Manager / Team Lead – South Africa Role OverviewThe SOC Engineer is responsible for security monitoring, incident triage and after-hours first-line service delivery for the company managed service clients. The role combines security operations with managed service delivery, ensuring that security events and technical issues are identified, assessed, documented, progressed and escalated appropriately. The SOC Engineer operates as part of the wider Service Delivery function, working closely with Service Desk Engineers and Service Delivery Management to provide reliable 24/7 support for contracted clients. What success looks like:
Security alerts are monitored, assessed and responded to appropriately.
Security incidents are accurately identified, documented and escalated.
24/7 clients receive consistent and professional after-hours support.
Tickets and incidents have clear ownership and progression.
Escalations contain sufficient technical context to enable efficient resolution.
Security trends, recurring issues and risks are identified and reported.
Continuously monitor security tools and alerting platforms.
Review security alerts and determine appropriate action.
Identify suspicious activity and potential threats.
Escalate security concerns according to defined processes
Assess and validate security incidents.
Perform initial investigation and impact assessment.
Support containment activities within agreed processes.
Maintain accurate incident records and investigation notes.
Escalate incidents requiring additional expertise or authority.
Provide first-line support for contracted 24/7 clients outside standard business hours.
Answer, log and categorise incoming requests.
Perform basic troubleshooting and resolution within agreed capability.
Progress tickets appropriately and maintain ownership.
Follow defined escalation routes for technical and security issues.
Ensure escalations contain accurate information, troubleshooting completed and relevant context.
Engage senior engineers and management when required based on impact or complexity.
Support smooth handover between teams.
Maintain accurate security and service documentation.
Track security incidents, trends, and recurring issues.
Contribute to incident reporting and service improvement activities.
Identify opportunities to improve monitoring, processes and knowledge sharing.
Security alerts and tickets responded to within agreed SLA
After-hours client support delivered within agreed SLA
Security incidents progressed within expected timescales
100% of tickets/incidents have clear ownership and next action
Ticket and incident notes meet quality standards
Reduction in avoidable rework or missed information
Correct escalation of technical and security issues
Quality of handovers to wider service desk team
Issues escalated before becoming client-impacting
Recurring issues identified and reported
Contribution to security documentation, processes and knowledge sharing
Completion of agreed training and certifications
Development of technical and security skills
Experience within an IT support/service desk environment.
Strong troubleshooting skills.
Understanding of Microsoft environments.
Experience working with tickets, priorities and SLAs.
Good written and verbal communication skills.
Interest in developing security capability
Exposure to:
Microsoft Defender
Microsoft 365 security
Endpoint security tools
Firewalls
Identity and access management
The ideal candidate will be a technically strong first-line engineer or junior second-line engineer looking to develop into security operations.
Experience within an MSP environment is advantageous. Relevant certifications are beneficial but not essential including:
CompTIA Security +
Microsoft SC-900
Microsoft SC-200
MD-102
MS-102
CompTIA Network+
Security alerts are monitored, assessed and responded to appropriately.
Security incidents are accurately identified, documented and escalated.
24/7 clients receive consistent and professional after-hours support.
Tickets and incidents have clear ownership and progression.
Escalations contain sufficient technical context to enable efficient resolution.
Security trends, recurring issues and risks are identified and reported.
Continuously monitor security tools and alerting platforms.
Review security alerts and determine appropriate action.
Identify suspicious activity and potential threats.
Escalate security concerns according to defined processes
Assess and validate security incidents.
Perform initial investigation and impact assessment.
Support containment activities within agreed processes.
Maintain accurate incident records and investigation notes.
Escalate incidents requiring additional expertise or authority.
Provide first-line support for contracted 24/7 clients outside standard business hours.
Answer, log and categorise incoming requests.
Perform basic troubleshooting and resolution within agreed capability.
Progress tickets appropriately and maintain ownership.
Follow defined escalation routes for technical and security issues.
Ensure escalations contain accurate information, troubleshooting completed and relevant context.
Engage senior engineers and management when required based on impact or complexity.
Support smooth handover between teams.
Maintain accurate security and service documentation.
Track security incidents, trends, and recurring issues.
Contribute to incident reporting and service improvement activities.
Identify opportunities to improve monitoring, processes and knowledge sharing.
Security alerts and tickets responded to within agreed SLA
After-hours client support delivered within agreed SLA
Security incidents progressed within expected timescales
100% of tickets/incidents have clear ownership and next action
Ticket and incident notes meet quality standards
Reduction in avoidable rework or missed information
Correct escalation of technical and security issues
Quality of handovers to wider service desk team
Issues escalated before becoming client-impacting
Recurring issues identified and reported
Contribution to security documentation, processes and knowledge sharing
Completion of agreed training and certifications
Development of technical and security skills
Experience within an IT support/service desk environment.
Strong troubleshooting skills.
Understanding of Microsoft environments.
Experience working with tickets, priorities and SLAs.
Good written and verbal communication skills.
Interest in developing security capability
Exposure to:
Microsoft Defender
Microsoft 365 security
Endpoint security tools
Firewalls
Identity and access management
The ideal candidate will be a technically strong first-line engineer or junior second-line engineer looking to develop into security operations.
Experience within an MSP environment is advantageous. Relevant certifications are beneficial but not essential including:
CompTIA Security +
Microsoft SC-900
Microsoft SC-200
MD-102
MS-102
CompTIA Network+
Desired Skills:
technically strong first-line engineer
or junior second-line engineer
looking to develop into security operations
o CompTIA Security +
o Microsoft SC-900
o Microsoft SC-200