Cybersecurity Incident Response Specialist

International Business Machines Corporation; Bogotá; Hybrid; COP 60,000,000 - 120,000,000; Full time

Job summary

IBM Consulting in Bogotá seeks a Technical or Security Consultant specializing in Intelligence & Operations to lead end-to-end security incident response and forensics. You will investigate ransomware, intrusions, and insider threats, using EDR/XDR tools and SIEM data to determine root causes and scope.

The role requires 3+ years in incident response, strong knowledge of MITRE ATT&CK, and practical DFIR experience across Windows, Linux, and AD environments.

Qualifications

• 3+ years in incident response, DFIR, or CSIRT roles handling advanced threats.
• Hands-on investigations of ransomware, intrusions, and insider threats.
• Experience with EDR/XDR platforms and SIEM tools.
• Knowledge of Windows, Linux, and Active Directory environments.

Responsibilities

• Lead and execute end-to-end security incident response activities from detection to containment and recovery.
• Participate in critical security incidents including ransomware and APT activity.
• Perform advanced investigations using EDR/XDR telemetry, SIEM data, and forensics.
• Conduct digital forensics on endpoints/servers; perform RCA and impact analysis.
• Investigate adversary behavior with MITRE ATT&CK and map TTPs to activity.
• Correlate logs with SIEM platforms; coordinate response with SOC, IT, Legal, and business teams.
• Develop, maintain, and execute CSIRT playbooks and post-incident reports.

Skills

Incident response

DFIR

EDR/XDR

MITRE ATT&CK

SIEM

Windows OS

Linux OS

Active Directory

English (Intermediate)

Education

Bachelor's Degree

Tools

Velociraptor

FTK

EnCase

Autopsy

Volatility

Microsoft Defender

CrowdStrike

SentinelOne

Cortex XDR

Job description

IBM Consulting in Bogotá seeks a Technical or Security Consultant specializing in Intelligence & Operations to lead end-to-end security incident response and forensics. You will investigate ransomware, intrusions, and insider threats, using EDR/XDR tools and SIEM data to determine root causes and scope.

The role requires 3+ years in incident response, strong knowledge of MITRE ATT&CK, and practical DFIR experience across Windows, Linux, and AD environments.