SecOps Manager / vCiso

Security Operations Manager / Service Delivery Manager - Client-facing, with a leading international cybersecurity organisation.

Microsoft Security, Azure, Identity, Vulnerability Management and Incident Response

Location: Cape Town
Employment Type: Permanent, Full-time
Industry: Cybersecurity Services
Package: R110K - R160K p/m plus company benefits
Standby: Participation in a weekly Security Operations and Incident Response rotation
Take Ownership of a Complex, Modern Security Environment

Are you an experienced Security Operations professional who enjoys taking ownership, improving security controls and remaining close to the technology?
Our client is a well-established international cybersecurity organisation that helps businesses protect their critical systems, data, identities and digital operations.
They are seeking a capable, hands-on Security Operations Manager to take responsibility for the management, governance and continuous improvement of a broad enterprise security environment.
The role encompasses:

• Endpoint security
• Vulnerability management
• Identity protection
• Microsoft 365 email and collaboration security
• Azure cloud security
• Network threat detection
• Identity and Access Management
• Security compliance
• Incident response
• Security Operations automation

This is not a role for someone who wants to manage from a distance. You will need to understand how the security platforms work, challenge configuration and coverage gaps, guide incident response, coordinate remediation and ensure that security controls remain healthy, compliant and effective.
Why Consider This Opportunity?

• Join an international organisation where cybersecurity is the core business.
• Take ownership of a diverse, modern security ecosystem.
• Work extensively with Microsoft Defender, Microsoft Azure, Nessus, Vectra, identity security and SecOps automation.
• Play an influential role in strengthening security operations and reducing organisational exposure.
• Help improve incident readiness, security governance and operational resilience.
• Collaborate with SOC, infrastructure, cloud, identity, compliance and business stakeholders.
• Shape security processes, operational playbooks, governance standards and automated response capabilities.
• Continue developing your expertise across endpoint, identity, email, cloud, network and vulnerability security.
• Join a technically focused environment that values accountability, collaboration and continuous improvement.

Company Benefits

The package includes:

• 20 working days’ paid annual leave per completed 12-month leave cycle.
• Company contribution towards a Discovery Health Medical Scheme .
• 4% company contribution towards the provident fund .
• Flexibility to select an additional employee provident fund contribution.
• Eligibility for a discretionary annual performance bonus , subject to company policy, individual performance and company profitability.
• Annual salary review process, subject to company policy, performance and eligibility requirements.
• Paid South African public holidays.
• Sick leave in accordance with company policy and applicable legislation.
• Family responsibility leave in accordance with applicable legislation.
• Exposure to enterprise cybersecurity platforms, complex environments and international security practices.

Your Key Responsibilities

Endpoint Security Management: Microsoft Defender for Endpoint

You will be responsible for maintaining a secure, compliant and well-managed endpoint environment, including:

• Ensuring appropriate endpoint coverage and compliance.
• Managing Microsoft Defender for Endpoint configurations.
• Managing endpoint security policies and baselines.
• Governing Attack Surface Reduction rules and controls.
• Managing endpoint firewall and network protection settings.
• Overseeing vulnerability exposure and endpoint security baselines.
• Monitoring threat detections, alerts and security incidents.
• Coordinating endpoint investigation, containment and remediation.
• Managing platform health, security updates and patching requirements.
• Reviewing, approving and governing security exclusions.
• Maintaining policy compliance and configuration standards.
• Managing integrations across the wider security ecosystem.
• Overseeing platform lifecycle management.
• Producing operational, risk and compliance reporting.

Vulnerability Management: Nessus

You will oversee the organisation’s vulnerability management capability, including:

• Ensuring scanning coverage across relevant servers and infrastructure.
• Managing authenticated vulnerability scans.
• Managing internal and external Nessus scanners.
• Maintaining scanner health, updates and patching.
• Reviewing and governing exclusions.
• Managing vulnerability policies, standards and compliance.
• Overseeing platform lifecycle requirements.
• Working with system owners to prioritise and coordinate vulnerability remediation.
• Tracking remediation progress.
• Escalating overdue or high-risk vulnerabilities.
• Producing vulnerability, risk and compliance reporting.

Identity Threat Protection: Microsoft Defender for Identity

You will manage identity threat detection and protection controls, including:

• Ensuring appropriate sensor deployment, coverage and compliance.
• Monitoring suspicious activity involving high-value identities.
• Managing identity protection policies and governance.
• Overseeing identity-related threat intelligence and alerts.
• Supporting exposure management and identity risk reduction.
• Managing security integrations and identity logging.
• Monitoring platform configuration, health and performance.
• Supporting identity governance and compliance requirements.
• Producing identity security and compliance reporting.
• Driving continuous hardening and lifecycle management.

Email and Collaboration Security: Microsoft Defender for Office 365

You will be responsible for the security controls protecting email and collaboration platforms, including:

• Managing domain authentication controls.
• Managing anti-spoofing policies.
• Managing anti-malware policies.
• Managing anti-phishing protections.
• Overseeing Mailbox Intelligence.
• Managing Safe Attachments.
• Managing Safe Links.
• Overseeing anti-spam and threat detection controls.
• Conducting email security investigations.
• Coordinating email-related incident response.
• Managing collaboration application protection.
• Overseeing configuration management and security hardening.
• Managing ongoing platform operations and maintenance.
• Producing operational and compliance reports.

Network Security: Vectra

You will manage and optimise the organisation’s network detection capability, including:

• Platform configuration management.
• Platform maintenance and health monitoring.
• Managing platform updates.
• Monitoring, investigating and triaging network security alerts.
• Fine-tuning detections.
• Managing legitimate exceptions and whitelisting requirements.
• Reducing false positives without weakening security controls.
• Coordinating alert remediation with appropriate technical teams.
• Maintaining effective integration between Vectra and the SOC ecosystem.

Microsoft Azure Cloud Security

You will govern and continuously strengthen security across the Microsoft Azure environment, including:

• Privileged Identity Management.
• Role-Based Access Control.
• Service principals.
• Managed identities.
• Emergency and break-glass accounts.
• Network security controls.
• Host and workload protection.
• Data protection and storage security.
• Platform security.
• Cloud configuration management.
• Threat detection, monitoring and logging.
• Identity and access logging.
• Security auditability.
• Governance, compliance and risk management.
• Zero Trust and identity-centric controls.
• Secure DevOps practices.
• CI/CD pipeline security.
• Cloud incident response and recovery.
• Security automation and remediation.
• Lifecycle management and compliance.
• Operational, risk and executive reporting.

Identity and Access Management Security

Your security-focused IAM responsibilities will include:

• Monitoring identity lifecycle compliance.
• Ensuring appropriate control of privileged accounts.
• Ensuring appropriate control of service accounts.
• Monitoring compliance with IAM policies and standards.
• Reviewing security compliance across groups and roles.
• Overseeing identity security monitoring and alerting.
• Managing identity protection and threat detection controls.
• Coordinating privileged-user access reviews.
• Coordinating third-party access reviews.
• Maintaining IAM security policies and baselines.
• Reporting on identity risks, exceptions and remediation.

Security Compliance Reviews

You will conduct and coordinate regular operational security reviews, including:

• Reviewing adherence to corporate security policies.
• Assessing configurations across implemented security platforms.
• Identifying control gaps, risks and areas of non-compliance.
• Agreeing corrective actions with accountable system owners.
• Tracking findings through to closure.
• Producing clear compliance and risk reports.
• Providing evidence of control effectiveness.
• Supporting security governance and audit requirements.

Security Incident Response

You will provide leadership during security incidents by:

• Responding to security incidents.
• Investigating and remediating security incidents.
• Coordinating technical and business response activities.
• Working across SOC, cloud, endpoint, identity, infrastructure and business teams.
• Ensuring incidents are appropriately contained.
• Coordinating recovery and remediation.
• Monitoring progress against defined corporate service levels.
• Escalating high-risk or overdue response activities.
• Supporting lessons-learned and post-incident reviews.
• Ensuring resulting control improvements are implemented and validated.

Security Operations Automation

A key part of the position will be improving efficiency and response speed through automation. You will:

• Identify repetitive or high-volume security processes suitable for automation.
• Implement automated Security Operations processes.
• Create and maintain automated response playbooks.
• Introduce consistent and repeatable investigation workflows.
• Introduce automated remediation processes where appropriate.
• Work with technical teams to integrate automation across the security ecosystem.
• Monitor the effectiveness of automated controls.
• Refine automated processes and playbooks continuously.
• Improve consistency, speed and accuracy across Security Operations.

Standby and Incident Support

• Participate in a weekly Security Operations and Incident Response standby rotation.
• Provide support for priority security events when required.
• Assist with the coordination of incidents outside normal operating hours.
• Ensure appropriate handover, escalation and documentation of incidents.

What We Are Looking For

We are looking for someone with strong, practical experience across several of the following areas:

• Security Operations or SecOps management.
• Enterprise endpoint security.
• Microsoft Defender for Endpoint.
• Microsoft Defender for Identity.
• Microsoft Defender for Office 365.
• Microsoft Azure security.
• Identity and Access Management security.
• Vulnerability management using Nessus.
• Network detection and response.
• Vectra or a comparable network detection platform.
• Security incident investigation, containment and remediation.
• Security configuration management and hardening.
• Compliance reviews and control testing.
• Security risk and operational reporting.
• Security automation and orchestration.
• Automated response playbooks.
• Working with SOC, infrastructure, cloud, identity and application teams.
• Coordinating remediation with technical system owners.
• Managing security platform health, lifecycle and integrations.
• Managing security policies, standards and baselines.

The Person We Need

You will be someone who:

• Takes end-to-end ownership of Security Operations outcomes.
• Is comfortable working at both management and technical levels.
• Remains technically involved rather than managing from a distance.
• Can assess whether security platforms are properly deployed, configured and maintained.
• Understands the relationship between endpoint, identity, email, cloud and network threats.
• Responds calmly and methodically during security incidents.
• Can manage and coordinate multiple remediation workstreams.
• Challenges security control gaps constructively.
• Drives agreed corrective actions through to completion.
• Communicates security risk clearly to technical and non-technical stakeholders.
• Works effectively across multiple teams and business units.
• Understands the importance of service levels, evidence, auditability and reporting.
• Looks for opportunities to simplify, standardise and automate.
• Is willing to participate in the weekly standby rotation.
• Is proactive, accountable and committed to continuous security improvement.

Desirable Certifications

Relevant certifications would be advantageous, particularly in areas such as:

• Microsoft Certified: Azure Security Engineer Associate.
• Microsoft Certified: Security Operations Analyst Associate.
• Microsoft identity and access certifications.
• Microsoft 365 security certifications.
• CISSP.
• CISM.
• GIAC or equivalent incident response certifications.
• ITIL or service management certifications.
• Cloud security certifications.
• Vulnerability management certifications.
• Security automation or orchestration certifications.

Equivalent practical experience will also be considered.
Ready to Take Ownership of a Complex Security Environment?

If you are an experienced security professional who combines technical credibility, operational leadership, incident coordination and continuous improvement, this could be an excellent next step.
You will have an opportunity to influence how security operations are governed, automated and continuously strengthened across a broad, modern security estate.
To apply, please submit your current CV together with your notice period, current location and salary expectations.
Our client’s identity will be disclosed to suitably qualified candidates during the recruitment process. All applications and discussions will be handled in strict confidence.