Cyber Risk Incident Manager

Reference: JHB003350-RM-1

Permanent | Hybrid | Gauteng | Microsoft

Duties & Responsibilities

We are looking for an experienced Cyber Risk Incident Manager with a strong knowledge in Microsoft house and proven experience within Security Operations Centre environment. Our client is a 100+ year-old South African organisation with a global footprint operating across complex industrial environments where technology, security and operational resilience are critical to business success. With a strong focus on protecting its digital infrastructure and managing cyber risk, the organisation is continuing to strengthen its cybersecurity capabilities. Beyond the technical requirements, we need someone who takes ownership when a security incident occurs. You should be decisive under pressure, analytical when assessing threats and comfortable coordinating multiple technical teams towards resolution. You will need to be a strong communicator who can work across SOC, IT Infrastructure, Service Desk, DevSecOps, Risk & Compliance and external security providers, while continuously looking for ways to improve security processes and controls. This is more than a cybersecurity operations role - it’s an opportunity to take ownership of an organisation’s cyber defence, lead critical incident response and vulnerability remediation, and directly influence its security resilience. If you’re ready to move beyond monitoring threats and take the lead in how they are contained, remediated and prevented, this is your opportunity to make an impact.

If you have an interest in this role, email your CV to Rarang@salixrecruitment.co.za.

Duties:

• Lead the remediation and resolution of cybersecurity incidents identified by the Security Operations Centre (SOC), ensuring effective containment and recovery.
• Coordinate vulnerability remediation and patch management across IT and infrastructure teams.
• Track, prioritise and ensure vulnerabilities are resolved within agreed timelines.
• Maintain and optimise Endpoint Detection & Response (EDR) and network segmentation controls.
• Develop and maintain incident response playbooks, procedures and operational workflows.
• Optimise SOC alert-handling and reporting processes to improve response efficiency and reduce false positives.
• Monitor and manage the performance of third-party SOC, vulnerability management and security service providers against agreed SLAs.
• Collaborate with IT Infrastructure, Service Desk, Application Security, DevSecOps and Risk & Compliance teams to strengthen the organisation’s security posture.
• Verify that security incidents and patching activities have been effectively resolved and completed.
• Support security audits, regulatory requirements and adherence to recognised cybersecurity frameworks.

Job Experience & Skills Required:

Qualifications:

• Matric (Grade 12)
• Bachelor’s degree in information security, Computer Science, Information Technology or a related field
• Industry-recognised cybersecurity certifications such as CISSP, GCIH, CEH, CompTIA Security+ or CySA+ will be advantageous.
• Microsoft security certifications such as SC-200, SC-300 or SC-900 will be advantageous.

Experience:

• 6–10 years’ progressive experience in cybersecurity operations.
• Hands-on experience in incident response and threat remediation.
• Proven experience working with or managing a Security Operations Centre (SOC), preferably a virtual or outsourced SOC.
• Strong experience in vulnerability management, patch management and remediation coordination.
• Experience maintaining and optimising EDR, endpoint protection and network security controls.
• Proven ability to develop and implement incident response playbooks and operational workflows.
• Experience managing or working with third-party security service providers and MSSPs.
• Exposure to enterprise IT environments, with SAP, Active Directory and hybrid cloud infrastructure experience advantageous.

Skills & Competencies:

• Strong incident response and remediation leadership skills.
• In-depth understanding of SOC operations, threat detection and vulnerability management.
• Strong knowledge of endpoint protection, EDR and network security architecture.
• Understanding of cybersecurity frameworks such as NIST and MITRE ATT&CK.
• Strong analytical and problem-solving abilities, with exceptional attention to detail.
• Ability to remain proactive and decisive under pressure, particularly during security incidents.
• Strong communication and collaboration skills across technical and non-technical teams.
• High level of accountability and ownership for operational security outcomes.
• Continuous improvement mindset with the ability to identify and implement more efficient security processes and controls.
• Strong technical writing skills, particularly for security procedures, playbooks and response documentation.

If you have not had any response in two weeks, please consider the vacancy application unsuccessful. Your profile will be kept on our database for any other suitable roles / positions.

Package & Remuneration

R 1600000 - R 1700000 - Annually