Cybersecurity Senior Consultant - EY GDS Spain

Cybersecurity Senior Consultant - Cyber Detection & Response

We are delighted to invite you to join the Cybersecurity Detection & Response (CDR) team within EY
GDS Poland Consulting Services. The role focuses on helping clients develop and improve their securitymonitoring, detection, and response capabilities across different technologies and operating
environments.

You will work in a dynamic consulting environment where assignments vary based on client needs. Your work may include SIEM engineering, detection development, log-source onboarding, security
integrations, incident response processes, playbooks, governance, operating model definition, and
security operations improvement.

The opportunity
As part of the CDR team, you will contribute to projects that vary in scope, technology, and complexity. Depending on the engagement, you may perform technical implementation, capability assessment, process and governance design, operational documentation, or broader transformation activities. We are looking for professionals with practical experience across multiple CDR areas who can adapt their knowledge to new technologies, client environments, and assignments.

Your key responsibilities
· Deliver technical and advisory activities across CDR projects.
· Apply AI-enabled security capabilities to support detection engineering, alert analysis,
investigations, response workflows, and security operations improvement.
· Develop and tune detection use cases based on relevant threats, risks, and available security
telemetry.
· Support log-source onboarding, data parsing and normalization, security-tool integration, and
SIEM improvement.
· Develop or improve detection and response policies, procedures, processes and playbooks
· Assess detection and response capabilities and define practical improvements across people,
process, technology, organization aspects.
· Configure or support SIEM, SOAR, EDR, XDR, and related security technologies.
· Translate technical and operational requirements into practical solutions and clear client
deliverables.
· Facilitate technical discussions and working sessions with client and internal teams.
· Provide technical guidance and knowledge sharing to less experienced team members.

Skills and attributes for success
To qualify for the role, you must have
· Professional experience in cybersecurity detection and response, security operations, or
incident response.
· Practical experience across multiple CDR areas, such as SIEM engineering, detection
development, log management, security automation, incident response, or SOC and CSIRT
improvement.

· Hands-on experience with at least one enterprise security monitoring, detection, and response
platform.
· Practical understanding of AI applications within CDR, such as detection development, alert
analysis, investigation, automation, or security operations improvement.
· Understanding of detection use-case development, security telemetry, and the security-data
lifecycle.
· Ability to analyze technical and operational requirements and translate them into practical
solutions.
· Ability to develop clear technical documentation, operational procedures, or playbooks.
· Strong analytical, problem-solving, and communication skills.
· Ability to work independently, adapt to different assignments, and manage defined project
responsibilities.
· Professional proficiency in English.

Ideally, you’ll also have
· Experience with Microsoft Sentinel, Splunk, or another enterprise SIEM platform.
· Knowledge of Microsoft Defender, CrowdStrike, or another EDR or XDR platform.
· Experience with SOAR, security workflow automation, or security-tool integrations.
· Working knowledge of KQL, SPL, PowerShell, Python, or similar languages.
· Experience using AI-enabled capabilities within SIEM, SOAR, EDR, XDR, or related cybersecurity
platforms.
· Familiarity with MITRE ATT&CK and established incident response methodologies.
· Exposure to CDR assessments, governance, operating models, service development, or
capability transformation.
· Experience with cloud security monitoring across Microsoft Azure, AWS, or Google Cloud.
· Relevant cybersecurity or technology certifications.