{"id":1766819,"url":"https://alion.io/job/ioco-technical-lead-soc-cyber-defense","title":"Technical Lead – SOC Cyber Defense","company":{"id":57386,"name":"iOCO","domain":"ioco.tech","url":"https://alion.io/company/ioco","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Simplify","truth_index":{"grade":"A","score":87,"open_postings":7,"ghost_share":0,"stale_share":0.714,"repost_share":0,"time_to_fill_p50_days":20,"computed_at":"2026-10-23T05:54:15Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Johannesburg, South Africa"],"countries":["ZA"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":32000,"max_usd":83000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":679},"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Crowdstrike","optional":false},{"name":"IBM QRadar","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Python","optional":false},{"name":"Red Teaming","optional":false},{"name":"SentinelOne","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false},{"name":"Zscaler","optional":false}],"status":"live","first_seen_at":"2026-08-12T00:00:00Z","employer_posted_date":"2026-10-03","last_verified_at":"2026-10-23T21:23:40Z","board_verified":true,"closed_at":null,"days_open":72,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":72},"description":"What you'll do:Define and execute a structured hypothesis-driven threat hunting programme aligned to MITRE ATT&CK TTPs relevant to client industries.\nOversee a hunt cadence (weekly/monthly) with documented hypotheses, datasets queried, findings, and new detections produced.\nTrack hunt effectiveness metrics: hunts executed, TTPs covered, detections created, threats uncovered, dwell time reduction.\nDrive proactive identification of stealthy, low-signal threats (LOLBins, identity abuse, persistence, lateral movement).\nEnsure hunt outcomes feed back into detection engineering, playbooks, and threat intel for continuous improvement.\nGovern the detection lifecycle - ideation, development, testing, deployment, tuning, retirement.\nReviewing versioned detection library (LQL - Logpoint Query Language) mapped to MITRE ATT&CK with coverage scoring.\nDrive measurable improvement in detection coverage % per tactic/technique, per client environment.\nDrive the Reduction in false positives and alert fatigue (signal-to-noise ratio, precision/recall metrics per rule).\nEnsure detections are tested via purple team / atomic red team / BAS tools before production release.\nReview detection-as-code practices (Python)\nOversee L1/L2 analyst quality depth of investigation, accuracy of triage, and quality of incident write-ups.\nGovern incident analysis standards (timelines, IOC pivoting, scope determination, attribution where relevant).\nEnsure root cause analysis (RCA) and lessons learned are captured and converted into preventative controls.\nWork with SOC OPS Manager to Maintain playbooks for top threat scenarios (ransomware, BEC, identity compromise, data exfiltration).\nDrive analyst skill uplift through case reviews, mentoring, and structured training paths.\nOperate a structured CTI capability across strategic, operational, and tactical levels.\nTrack threat actor groups, campaigns, and TTPs relevant to the organisation and client base.\nEnsure CTI informs risk decisions, vulnerability prioritisation, and board reporting.Monitor geopolitical, regulatory, and industry events that may translate into cyber risk (POPIA, sanctions, hacktivism).\nTrack exposure to active campaigns and trigger proactive defensive actions.\nMaintain real-time situational awareness of the threat landscape - global, regional (Africa/SA), and sector-specific.\nMaintain transparent metrics on detection coverage, hunt outcomes, intel value, and research impact.\n\nProvide daily/weekly intel briefings to SOC Manager\nGovern effective use of GuardSix, EDR (WithSecure), email security (Mimecast), Zscaler, and supporting platforms for detection and hunting.\nEnsure log source coverage and data quality required for hunting and analytics\nReview KOUEBA, identity analytics, and behavioural detections beyond signature-based controls. (Align with L3)\nMaintain audit-ready documentation: hunt records, detection change logs, intel reports, research artefacts.\nEnsure ethical handling of intel, OSINT, and research (legal, privacy, and disclosure boundaries respected).\nContribute to enterprise risk register with threat-informed risk inputs.\nManage and grow a multi-disciplinary team (hunters, detection engineers, analysts, intel analysts, researchers).\nParticipate/Facilitate internal purple team exercises, CTFs, and tabletop scenarios to build muscle memory.\nContribute to threat-informed reporting to CISO, exec, and clients not just volumes, but business-relevant insight.\nTranslate technical threat data into business risk language (impact, likelihood, exposure, recommended action).\nProvide quarterly threat landscape and defensive posture reviews to leadership and key clients.\nPartner closely with SOC Operations Manager (feed detections/playbooks), Exposure and Vulnerability Management (intel-led prioritisation), IR (threat context), and GRC (risk inputs).\nEngage with client CISOs and security teams on threat briefings and joint exercises.\nDrive measurable year-on-year improvement in detection coverage, hunt yield, and intel-driven outcomes.\nYour Expertise:\n8-12+ years' experience in Cybersecurity Operations.\n5+ years' experience in Threat Hunting, Detection Engineering, Threat Intelligence, Incident Response, or Advanced SOC Operations.\nProven experience leading Threat Hunting, Detection Engineering, CTI, and SOC Analysis teams.\nExperience operating within enterprise or MSSP security environments.\nExperience building and managing detection programs mapped to MITRE ATT&CK.\nExperience developing and tuning SIEM detection use cases.\nExperience performing advanced threat investigations involving:Identity compromise \n\nRansomware\nBusiness Email Compromise (BEC)\nData exfiltration\nInsider threats\nCloud attacks\nLateral movement\nLOLBins and living-off-the-land techniques\n\nExperience presenting threat intelligence and security risks to executive leadership and clients.\nExperience managing threat-informed security programs and continuous improvement initiatives.\n Qualifications:\nQualification Essential Competency\nStrong practical experience with:SIEM Platforms (e.g Logpoint, Sentinel, Splunk, QRadar, ArcSight)\nEDR/XDR Platforms (e.g. WithSecure, CrowdStrike, Defender, SentinelOne)\nSOAR Platforms\nVulnerability Management Platforms\nIdentity Security Solutions\nUEBA Platforms\nCloud Security Controls\nThreat Intelligence Platforms (TIP)\nMITRE ATT&CK\nCIS/NIST Cyber Security Framework\nCyber Threat Intelligence Lifecycle\nDetection Engineering Frameworks\nThreat Modelling\n\nQualifications preferred/ knowledgeCTIA (Certified Threat Intelligence Analyst)\nCREST CRT\nCREST CCTIM\n\nOther information applicable to the opportunity:\nPermanent position\nLocation: Johanesburg\nPhysical: Demands Sitting\nTravel: Own Transport\nWhy work for us?\nWant to work for an organization that solves complex real-world problems with innovative software solutions? At iOCO, we believe anything is possible with modern technology, software, and development expertise. We are continuously pushing the boundaries of innovative solutions across multiple industries using an array of technologies.?\nYou will be part of a consultancy, working with some of the most knowledgeable minds in the industry on interesting solutions across different business domains.?\nOur culture of continuous learning will ensure that you will have all the opportunities, tools, and support to hone and grow your craft.?\nBy joining IOCO you will have an open invitation to developer inspiring forums. A place where you will be able to connect and learn from and with your peers by sharing ideas, experiences, practices, and solutions.?\niOCO is an equal opportunity employer with an obligation to achieve its own unique EE objectives in the context of Employment Equity targets. Therefore, our employment strategy gives primary preference to previously disadvantaged individuals or groups.","description_format":"text","description_chars":6835,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Continuous learning","Equity"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","C4ISR","Incident Response","Threat Intelligence"],"lifecycle":[{"event":"open","at":"2026-10-03T14:14:15Z"}],"visa":[],"liveness":{"score":12,"band":"cold","label":"Long shot","p_open":1,"p_active":0.427,"p_room":0.28,"age_days":72,"expected_fill_days":20,"reasons":["conf:3","velocity","win:tail","crowd:"],"computed_at":"2026-10-23T05:54:15Z"},"pay":null,"html_url":"https://alion.io/job/ioco-technical-lead-soc-cyber-defense","json_url":"https://alion.io/job/ioco-technical-lead-soc-cyber-defense.json","meta":{"generated_at":"2026-10-23T22:36:55Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":5474,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-24T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":57386},"rest":"https://alion.io/mcp/rest/get_company?id=57386"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fioco-technical-lead-soc-cyber-defense"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fioco-technical-lead-soc-cyber-defense"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fioco-technical-lead-soc-cyber-defense"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/ioco-technical-lead-soc-cyber-defense\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fioco-technical-lead-soc-cyber-defense"}]}