Technical Consultant-Threat Detection Content & Administration

Introduction

Build a career at IBM Consulting grounded in long-term client partnerships and global collaboration. You’ll work with leading organizations across industries, supporting their hybrid cloud and AI initiatives. Backed by strategic partners, IBM technology, and Red Hat, you’ll have the capabilities to drive meaningful change and accelerate client outcomes. At IBM Consulting, curiosity is a key driver of success—you’ll be encouraged to challenge established approaches, try new ideas, and build solutions that produce measurable results. Our culture of growth and empathy supports your long-term development while recognizing and valuing your individual skills and experiences.

Your Role And Responsibilities

As a Technical Consultant in Threat Detection Content & Administration, you will oversee the administration and maintenance of security technology infrastructure, including SIEM, SOAR, EDR, AV, and Cloud security controls. You will create, deploy, and manage use cases, rules, and security policy recommendations to support reliable and efficient infrastructure operations.

Your Primary Responsibilities Will Include

• Develop Use Cases and Rules: Build and tune use cases, rules, and optimization reports to detect malicious activity, and deploy them into the client environment. This requires analyzing system and network activity, indicators of compromise, and attacker tactics.
• Maintain Infrastructure: Keep security infrastructure patched, upgraded, and operating effectively, applying expertise in Security Incident & Event Management (SIEM), Endpoint Detection and Response technology, and network security technologies.
• Apply Threat Frameworks: Use the MITRE ATT&CK framework to classify attacks, determine attack attribution, and evaluate risk, and apply the NIST Cybersecurity framework to assess the risk associated with threats.
• Deliver Security Policy Recommendations: Recommend security policies to clients based on your expertise in security technologies and threat analysis.
• Optimize Security Controls: Monitor and continuously optimize security controls to ensure efficient and effective threat detection and response.
  
  

Preferred Education

Master's Degree

Required Technical And Professional Expertise

• Exposure to Security Technology Infrastructure: Experience managing and maintaining security technology infrastructure, including SIEM, SOAR, EDR, AV, and Cloud security controls.
• Threat Analysis and Mitigation: Experience analyzing system and network activity, indicators of compromise, and attacker tactics to identify malicious activity.
• Security Frameworks and Standards: Experience applying the MITRE ATT&CK framework to classify attacks, identify attack attribution, and assess risk, as well as utilizing the NIST Cybersecurity framework to evaluate the risk of threats.
• Security Technologies Expertise: Experience with Security Incident & Event Management (SIEM), Endpoint Detection and Response technology, anti-malware, anti-spam, and network security technologies.
• Threat Detection and Response: Experience developing and deploying use cases, rules, and security policy recommendations to ensure efficient infrastructure functionality and effective threat detection and response.
  
  

Preferred Technical And Professional Experience

• Proficiency in Cloud Security: Experience with cloud security controls and technologies, including deployment and management of cloud-based security solutions.
• Knowledge of Anti-Malware Tools: Exposure to anti-malware and anti-spam technologies, including their integration with SIEM and EDR systems.
• Familiarity with Network Logging: Experience with general user and network activity logging policies, including log collection and analysis.