Cybersecurity Remediation Engineer - CISO

Introduction

Specialization Areas May Include

• Scripting, Automation & Infrastructure as Code: Proficiency in Python, Ansible, Terraform, or equivalent tools
• Cloud & Virtualized Environments: Experience with IBM Cloud, AWS, Azure, GCP, and virtualization/container platforms
• Operating Systems & Networking: Knowledge of Windows or Linux, including network segmentation, SDN, and isolation strategies
• Security Technologies: Familiarity with EDR, NGFW, IDS, SIEM, SOAR, and associated platforms
  
  

Primary Responsibilities

• Assist in containment, recovery, and post-incident remediation by determining root causes and implementing technical solutions to minimize recurrence.
• Collaborate with product, engineering, and infrastructure teams to integrate security into existing processes.
• Perform security and risk assessments on applications, platforms, and infrastructure, which includes threat modeling and focused technical reviews.
• Utilize security principles to safeguard systems and data, ensuring their availability, authentication, authorization, confidentiality, and integrity.
• Generate technical documentation that provides remediation guidance and outlines security best practices.
• Create or implement tools to facilitate the detection, prevention, and analysis of security threats.
  
  

Your Role and Duties

The CISO Remediation Team is seeking to welcome a cybersecurity Remediation Engineer as part of the broader Cyber Defense organization. In this position, you will play a vital role in driving the technical resolution of security risks across the IBM enterprise, working at the convergence of security operations, engineering, and architecture. Your contributions will assist teams in recovering from incidents, addressing vulnerabilities, and implementing sustainable, scalable security enhancements.

Depending on your experience and the task at hand, you may directly resolve issues, collaborate with engineering teams to implement fixes, or design repeatable remediation strategies. This role is not primarily focused on SOC, detection, or application security pipeline management but closely partners with those teams to achieve successful remediation outcomes.

The ideal candidate excels in high-pressure situations, possesses a mindset that encompasses both attacker and defender viewpoints, and communicates effectively with both technical and non-technical audiences.

This position encompasses various technical domains. While candidates are not expected to possess expertise in all areas, strong applicants should demonstrate deep knowledge in one or two domains, along with a working understanding of related fields.

Preferred Education

Bachelor's Degree

Essential Technical and Professional Qualifications

• 4-8 years of experience in security engineering or related engineering disciplines (e.g., networking, infrastructure, cloud, or application development).
• Experience in supporting incident response or post-incident remediation efforts.
• Familiarity with cloud platforms, CI/CD pipelines, containerization, and Kubernetes.
• Experience in utilizing automation and AI to decrease mean time to remediation (MTTR).
• Knowledge of Agile development methodologies.
• Basic understanding of cybersecurity frameworks and regulations and their influence on risk-based remediation strategies (e.g., NIST CSF, NIST 800-series, ISO 27001, PCI).
• Certifications are advantageous but not mandatory; practical experience is highly valued (e.g., CISSP, CISM, OSCP, SANS, cloud security certifications).
  
  

Preferred Technical and Professional Experience

• Capability to work independently or collaboratively as part of a team while effectively navigating ambiguous, fast-paced environments.
• Strong analytical abilities with a keen attention to detail and a proactive approach to problem-solving.
• Excellent interpersonal and communication skills, enabling effective collaboration across engineering, security, and business teams, and the ability to convey technical remediation steps to non-technical stakeholders.
• Ability to collaborate effectively and influence remediation outcomes within federated teams, drawing from experience.
• Experience in conducting security assessments and translating findings into actionable engineering recommendations.
• Experience in applying and maintaining secure configurations across systems, networks, or applications.
• Ability to utilize AI tools to enhance triage, remediation recommendations, and incident response, with appropriate human oversight and judgment.
• Understanding of vulnerability management, common attack vectors, and mitigation strategies (e.g., OWASP Top 10, MITRE ATT&CK).