Do meaningful work on the front lines

About the role

We are looking for an intermediate Offensive Security Consultant to join our team. You will conduct authorised security assessments across client environments, identify and validate vulnerabilities, clearly communicate business and technical risk, and help clients strengthen their security posture.

This role is suited to a hands-on penetration tester who has strong technical fundamentals, can deliver standard assessments with limited supervision, and wants to continue developing through structured training and exposure to varied environments.

The role is primarily office-based, with flexible working hours. You must be willing and able to travel when required for client engagements, including outside South Africa.

Key responsibilities

• Conduct authorised penetration tests and vulnerability assessments across web applications, APIs, internal and external infrastructure, and networks.
• Identify, manually validate and safely demonstrate security vulnerabilities while minimising operational risk.
• Perform reconnaissance, enumeration, exploitation and post-exploitation activities within agreed rules of engagement.
• Assess common authentication, authorisation, session-management and access-control weaknesses.
• Use commercial and open-source security tools effectively, while avoiding over-reliance on automated scanner results.
• Record clear, reproducible evidence and maintain accurate engagement notes.
• Produce high-quality reports describing technical findings, business impact, risk ratings and practical remediation guidance.
• Present and explain findings to technical stakeholders and assist with remediation discussions.
• Conduct retesting to confirm that reported vulnerabilities have been addressed.
• Work within defined scopes, methodologies, legal authorisations and client confidentiality requirements.
• Collaborate with senior consultants and other team members on complex engagements.
• Keep current with offensive-security techniques, vulnerabilities and industry developments.

Minimum requirements

• At least two years of relevant, hands-on penetration-testing or offensive-security experience in a professional environment.
• At least two recognised penetration-testing certifications. Relevant examples include OSCP, PNPT, CPTS, CRTO, CRTP, eCPPT, eWPT/eWPTX, GPEN or equivalent practical offensive-security credentials.
• Demonstrable experience testing web applications and APIs using tools such as Burp Suite.
• Working knowledge of internal and external network penetration testing, including common Windows, Linux and Active Directory environments.
• Practical experience with tools such as Nmap, Nessus or equivalent vulnerability scanners, Metasploit, Linux security tooling and common enumeration frameworks.
• A sound understanding of the OWASP Top 10, common infrastructure vulnerabilities, networking, operating systems and security fundamentals.
• The ability to distinguish exploitable vulnerabilities from false positives and explain their practical impact.
• The ability to produce clear, professional technical reports in English.
• Strong analytical, troubleshooting and communication skills.
• A high standard of professional ethics, discretion and respect for confidentiality.
• Willingness and ability to travel for client engagements when required.
• Legal eligibility to work in South Africa.

Advantageous experience

• Active Directory attack-path analysis and privilege escalation.
• Mobile, cloud, wireless or thick-client security testing.
• Scripting or automation using Python, PowerShell or Bash.
• Secure code review or familiarity with modern development practices.
• Consulting experience, including client-facing delivery and scoping.
• Participation in responsible disclosure programmes, CTFs, security research or other demonstrable practical work.
• A relevant tertiary qualification in information technology, computer science, cybersecurity or a related field.

What we offer

• Company-provided devices and the professional tooling required for the role.
• A structured training and certification development path.
• Company-supported learning, laboratory access and relevant certification examinations.
• Exposure to varied client environments and opportunities to broaden your offensive-security capability.
• Additional company benefits discussed during the recruitment process.

Application process

Please submit your CV together with a list of your current certifications. You may also include links to relevant public work, such as technical articles, security research, responsible disclosures, GitHub projects or CTF profiles.

Shortlisted candidates will complete a practical, role-relevant technical assessment and discuss their approach and findings with the team. All assessment activities will be conducted in an authorised environment.

We are committed to fair and responsible recruitment. Appointment is subject to appropriate reference and background checks relevant to the nature of the role.

About the role

We are looking for an intermediate SOC Technical Specialist to join our team. This is a hybrid security operations and technical enablement role combining day-to-day SOC monitoring, investigation and threat hunting with the implementation, configuration and maintenance of SOC technologies and client installations.

The successful candidate will be comfortable working across Elastic, Wazuh, Linux and Windows environments. You will investigate security events, improve detection quality, support log-source onboarding, maintain the health of SOC platforms, and assist with deploying and supporting SOC installations in client environments.

This role is suited to someone with solid SOC fundamentals who enjoys both analysing security activity and working directly with the technology that enables effective monitoring. The role is primarily office-based, with flexible working hours. You must be willing and able to travel when required for client installations and support.

Key responsibilities — Security monitoring and response

• Monitor and triage security alerts, events and cases across client environments.
• Investigate suspicious activity using endpoint, network, identity, application and other relevant telemetry.
• Determine alert severity, validate potential threats, identify false positives and escalate confirmed or high-risk incidents appropriately.
• Conduct initial incident analysis, evidence collection, scoping and containment support in accordance with approved procedures.
• Perform proactive threat hunting based on hypotheses, threat intelligence, observed behaviours and environmental risk.
• Map observed activity to relevant tactics and techniques, including the MITRE ATT&CK framework.
• Create clear investigation notes, incident timelines and client-facing reports.
• Communicate findings, recommended actions and remediation guidance to technical stakeholders.
• Support detection tuning and contribute to the continuous improvement of SOC playbooks and operational procedures.

Key responsibilities — SOC implementation and platform support

• Assist with the deployment, configuration and maintenance of Elastic- and Wazuh-based SOC installations.
• Install, configure and troubleshoot Wazuh agents and relevant Elastic data-collection components across Windows and Linux systems.
• Support log-source onboarding, parsing, normalisation and validation to ensure that required telemetry is collected correctly.
• Configure and maintain dashboards, alerts, detection rules, decoders, integrations and supporting workflows.
• Tune detections to improve coverage and reduce unnecessary noise without suppressing legitimate threats.
• Monitor platform health, ingestion, agent connectivity, storage utilisation, performance and data availability.
• Assist with upgrades, configuration changes, backup activities, testing and technical documentation.
• Troubleshoot issues across SOC applications, operating systems, services, networks, certificates, permissions and data pipelines.
• Support client installations and maintenance activities remotely and on site when required.
• Maintain accurate system documentation, configuration records and implementation notes.
• Work with consultants, infrastructure teams and client stakeholders to resolve technical issues and improve security visibility.

Minimum requirements

• At least two years of relevant professional experience in a SOC, security monitoring, security engineering or closely related technical security role.
• Hands-on operational experience with both Elastic and Wazuh in a production, client or comparable lab environment.
• Practical experience investigating alerts and security events using a SIEM or security analytics platform.
• Working knowledge of the Elastic Stack, including Elasticsearch, Kibana and common data-ingestion components such as Elastic Agent, Beats or Logstash.
• Working knowledge of Wazuh components, agent management, rules, decoders, alerting and troubleshooting.
• Confident administration and troubleshooting skills across both Linux and Windows operating systems.
• Understanding of Windows event logging, Linux system and authentication logs, endpoint telemetry and common security log sources.
• Sound knowledge of networking fundamentals, including TCP/IP, DNS, HTTP/S, firewalls, proxies and common network services.
• Understanding of common attack techniques, malware behaviour, indicators of compromise, vulnerability concepts and incident-response fundamentals.
• Familiarity with threat-hunting methods and the MITRE ATT&CK framework.
• Ability to interpret raw logs, correlate events across multiple sources and distinguish suspicious activity from normal behaviour.
• Ability to document technical work and produce clear, professional investigation notes and reports in English.
• Strong analytical, troubleshooting and communication skills.
• A high standard of professional ethics, discretion and respect for client confidentiality.
• Willingness and ability to travel for client installations and support when required.
• Legal eligibility to work in South Africa.

Advantageous experience

• Creating or tuning detection rules using KQL, Lucene, EQL, Sigma or comparable query and detection formats.
• Integrating firewalls, endpoint tools, identity platforms, cloud services, threat-intelligence feeds and other security products with a SIEM.
• Experience with Fleet, Elastic Security, Wazuh Indexer, Wazuh Dashboard or clustered deployments.
• Scripting or automation using Python, PowerShell or Bash.
• Exposure to incident response, digital forensics, malware triage or vulnerability management.
• Experience supporting multi-client or managed security service environments.
• Familiarity with ticketing, case-management and service-management processes.
• Relevant certifications such as CompTIA Security+, CySA+, Blue Team Level 1, Elastic certifications, Microsoft security certifications, SC-200, GIAC certifications or equivalent credentials.
• A relevant tertiary qualification in information technology, computer science, cybersecurity or a related field.

What we offer

• Company-provided devices and the professional tooling required for the role.
• A structured training and certification development path.
• Company-supported learning, laboratory access and relevant certification examinations.
• Exposure to varied client environments and opportunities to develop both security-analysis and SOC-engineering capability.
• Flexible working hours within an office-based environment.
• Additional company benefits discussed during the recruitment process.

Application process

Please submit your CV together with a summary of your practical experience with Elastic, Wazuh, Linux, Windows and SOC operations. You may also include a list of current certifications and links to relevant public technical work.

Shortlisted candidates will complete a practical, role-relevant technical assessment. This may include alert investigation, log analysis, detection logic and troubleshooting a controlled SOC installation. Candidates will discuss their approach and findings with the team, and all assessment activities will be conducted in an authorised environment.

We are committed to fair and responsible recruitment. Appointment is subject to appropriate reference and background checks relevant to the nature of the role.