About the job

Agents, brokers and direct customers all buy through our platforms, with policy administration on Guidewire. Our claims organisation handles more than 400,000 claims a year, including catastrophe response after hurricanes and hail. Licensing (property and casualty, life and health) is paid for, with study time during work hours.

Job summary:

Our Johannesburg team is growing and we are hiring an Information Security Analyst. We need someone who writes up incidents clearly enough that the next shift can pick them up without asking.

Duties:

Review firewall, proxy, VPN and authentication logs for suspicious activity.
Monitor and triage alerts in Splunk, Microsoft Sentinel, QRadar or Elastic SIEM.
Tune noisy detection rules with the security engineering team.
Run vulnerability scans with Tenable Nessus, Qualys or Rapid7 and track remediation with system owners.
Hand off open cases at shift change with clear notes.
Report on security awareness training and phishing simulation results.
Check threat intelligence feeds and IOCs against our environment.
Analyse reported phishing emails, check headers and URLs, and purge malicious messages.

What you need:

Ability to work shifts, including some nights, weekends or holidays as scheduled.
Understanding of TCP/IP, DNS, HTTP and common ports and protocols.
Experience reading Windows Event Logs, Sysmon and Linux logs.
CompTIA Security+ or equivalent (or ability to obtain within six months)
Basic scripting in PowerShell or Python.
Familiarity with the MITRE ATT&CK framework.

Preferred:

Malware analysis in a sandbox.
CySA+, GCIH, GCIA or BTL1 certification.
KQL or SPL query writing.

Compensation: R55,000 - R66,000 per month

Perks and benefits:

Medical aid contribution.
Provident fund.
Group life cover.
Study assistance.
13th cheque.

Candidates must be eligible to work in South Africa.

Start: Immediately.

Demo job created on 11jobs for testing and demonstrations. It is not an actual opening at Brackwater Assurance.