Technical Consultant-Threat Detection Content & Administration

A career in IBM Consulting is built on long-term client relationships and close collaboration worldwide. You'll work with leading companies across industries, helping them shape their hybrid cloud and AI journeys. With support from our strategic partners, robust IBM technology, and Red Hat, you'll have the tools to drive meaningful change and accelerate client impact. At IBM Consulting, curiosity fuels success. You'll be encouraged to challenge the norm, explore new ideas, and create innovative solutions that deliver real results. Our culture of growth and empathy focuses on your long-term career development while valuing your unique skills and experiences. As a Technical Consultant in Threat Detection Content & Administration, you will manage and maintain security technology infrastructure, including SIEM, SOAR, EDR, AV, and Cloud security controls. You will develop and deploy use cases, rules, and security policy recommendations to ensure efficient infrastructure functionality. Your primary responsibilities will include:

• Manage Security Infrastructure: Manage and maintain security technology infrastructure, ensuring that systems are patched, upgraded, and functioning efficiently. This includes developing use cases, rules, and run books, and deploying them to the client environment.
• Analyze System Activity: Analyze and translate system and network activity, indicators of compromise, and attacker tactics to identify malicious activity, applying the MITRE ATT&CK framework to classify attacks and assess risk.
• Develop Security Policy: Develop and recommend security policy based on expertise in Security Incident & Event Management (SIEM), Endpoint Detection and Response technology, anti-malware, anti-spam, network security technologies, and general user and network activity logging policies.
• Optimize Security Controls: Tune and optimize security controls, including SIEM, SOAR, EDR, AV, and Cloud security controls, to ensure efficient threat detection and response.
• Evaluate Risk: Evaluate the risk of threats using the NIST Cybersecurity framework and provide recommendations to mitigate identified risks.
• Security Technology Infrastructure Management: Experience with managing and maintaining security technology infrastructure, including SIEM, SOAR, EDR, AV, and Cloud security controls, ensuring systems are patched, upgraded, and functioning efficiently.
• Threat Analysis and Mitigation: Experience with analyzing and translating system and network activity, indicators of compromise, and attacker tactics to identify malicious activity, utilizing frameworks such as MITRE ATT&CK for attack classification and risk assessment.
• Security Policy Development: Experience with developing and recommending security policy based on expertise in Security Incident & Event Management (SIEM), Endpoint Detection and Response technology, anti-malware, anti-spam, network security technologies, and general user and network activity logging policies.
• Security Control Optimization: Experience with tuning and optimizing security controls, including SIEM, SOAR, EDR, AV, and Cloud security controls, to ensure efficient threat detection and response.
• Risk Evaluation and Mitigation: Experience with evaluating the risk of threats using the NIST Cybersecurity framework and providing recommendations to mitigate identified risks.
• Proficiency in NIST Framework: Experience with utilizing the NIST Cybersecurity framework to evaluate the risk of threats and provide recommendations to mitigate identified risks.
• MITRE ATT&CK Framework Knowledge: Experience with applying the MITRE ATT&CK framework to classify attacks, identify attack attribution, and assess risk.
• Cloud Security Controls Expertise: Experience with managing and maintaining cloud security controls to ensure efficient threat detection and response.