Johannesburg: L2 SOC Analyst (Intermediate / Investigator) – immediately posted by Securejedi

Role Level: Intermediate (L2)Role PurposeThe L2 SOC Analyst validates and investigates escalated alerts, confirms incidents, coordinates containment actions, and ensures accurate, timely communication to stakeholders. The role bridges triage and deep investigation, with ownership of day-to-day incident handling within SLA targets.Key ResponsibilitiesInvestigate escalated alerts using SIEM/XDR tooling, endpoint/network telemetry, and threat-intel context.Validate incidents, determine scope/impact, and recommend containment or remediation steps.Manage incident lifecycle in ITSM/SOAR: evidence collection, timeline building, and closure documentation.Tune noisy detection rules in collaboration with L3 to reduce false positives.Perform third-party/vendor risk indicator checks where applicable.Review dark-web/exposure indicators and include findings in incident context.Lead operational handovers and provide feedback/mentoring to L1 analysts.Support reporting inputs: incident trends, top use cases, and operational health.Minimum RequirementsExperience: 25 years in a SOC/Blue Team environment with hands-on incident investigation.Technical Skills:Competent event analysis, enrichment, and escalation.Working knowledge of common attack techniques and IOC/IOA validation.Familiarity with vulnerability management outputs and risk-based prioritization.Confident use of ITSM/SOAR workflows.Platform Experienc