Professional

International Business Machines Corporation; Bogotá; Hybrid; COP 60,000,000 - 120,000,000; Full time

Job summary

IBM Consulting in Bogotá seeks a Technical or Security Consultant specializing in Intelligence & Operations to lead end-to-end security incident response and forensics. You will investigate ransomware, intrusions, and insider threats, using EDR/XDR tools and SIEM data to determine root causes and scope.

The role requires 3+ years in incident response, strong knowledge of MITRE ATT&CK, and practical DFIR experience across Windows, Linux, and AD environments.

Qualifications

• 3+ years in incident response, DFIR, or CSIRT roles handling advanced threats.
• Hands-on investigations of ransomware, intrusions, and insider threats.
• Experience with EDR/XDR platforms and SIEM tools.
• Knowledge of Windows, Linux, and Active Directory environments.

Responsibilities

• Lead and execute end-to-end security incident response activities from detection to containment and recovery.
• Participate in critical security incidents including ransomware and APT activity.
• Perform advanced investigations using EDR/XDR telemetry, SIEM data, and forensics.
• Conduct digital forensics on endpoints/servers; perform RCA and impact analysis.
• Investigate adversary behavior with MITRE ATT&CK and map TTPs to activity.
• Correlate logs with SIEM platforms; coordinate response with SOC, IT, Legal, and business teams.
• Develop, maintain, and execute CSIRT playbooks and post-incident reports.

Skills

Incident response

DFIR

EDR/XDR

MITRE ATT&CK

SIEM

Windows OS

Linux OS

Active Directory

English (Intermediate)

Education

Bachelor's Degree

Tools

Velociraptor

FTK

EnCase

Autopsy

Volatility

Microsoft Defender

CrowdStrike

SentinelOne

Cortex XDR

Job description

Bogota, Cundinamarca, ColombiaProfessionalIntroductionA career in IBM Consulting is built on long-term client relationships and close collaboration worldwide. You'll work with leading companies across industries, helping them shape their hybrid cloud and AI journeys. With support from our strategic partners, robust IBM technology, and Red Hat, you'll have the tools to drive meaningful change and accelerate client impact. At IBM Consulting, curiosity fuels success. You'll be encouraged to challenge the norm, explore new ideas, and create innovative solutions that deliver real results. Our culture of growth and empathy focuses on your long-term career development while valuing your unique skills and experiences.Your role and responsibilitiesDescription and Responsibilities:As a Technical or Security Consultant specializing in Intelligence & Operations, you play a crucial role inhelping Client IT understand and address key security issues, exposures, and vulnerabilities. Your expertisein security intelligence and operations enables you to articulate effective security strategies and mitigationmeasures.Your primary responsibilities will include:- Lead and execute end-to-end security incident response activities, from detection to containment, eradication, and recovery.- Participate directly in critical security incidents, including ransomware, intrusions, APT activity, and insider threats.- Perform advanced incident investigations using EDR/XDR telemetry, SIEM data, and forensic artifacts.- Conduct digital forensics on endpoints and servers, including memory, disk, and system artifact analysis.- Perform root cause analysis (RCA) and determine the scope and impact of security incidents.- Investigate adversary behavior using MITRE ATT&CK and map TTPs to incident activity.- Correlate logs and security events using SIEM platforms to support investigations.- Coordinate technical response efforts with SOC, IT, Legal, and business teams during incident response and crisis situations.- Develop, maintain, and execute CSIRT playbooks and response procedures.- Produce forensic documentation and post-incident reports, including timelines, impact assessments, and remediation recommendations.Required educationBachelor's DegreePreferred educationBachelor's DegreeRequired technical and professional expertiseRequirements:- 3+ years of experience in incident response, DFIR, or CSIRT roles, handling advanced threats.- Proven hands-on experience investigating ransomware, APTs, intrusions, and insider threat incidents.- Strong experience with EDR/XDR platforms, such as Microsoft Defender, CrowdStrike, SentinelOne, and Cortex XDR.- Practical knowledge of digital forensics and DFIR tools, including Velociraptor, FTK, EnCase, Autopsy, and Volatility.- Strong skills in log analysis and event correlation using SIEM technologies.- Solid understanding of Windows, Linux, and Active Directory environments.- Experience performing MITRE ATT&CK-based investigations and adversary TTP analysis.- Familiarity with incident response frameworks, including NIST SP 800-61, NIST CSF, and ISO/IEC 27035.- Basic experience working in cloud environments such as Azure and AWS.- Ability to work under pressure during high-impact security incidents.- Intermediate English level (technical reading and communication).Preferred technical and professional experiencePreferred:- Relevant security and incident response certifications, such as GCIH, GCED, GCFA, SC-200, or vendor-specific DFIR / EDR certifications.### ABOUT BUSINESS UNITIBM Consulting is IBM's consulting and global professional services business, with market leading capabilities in business and technology transformation. With deep expertise in many industries, we offer strategy, experience, technology, and operations services to many of the most innovative and valuable companies in the world. Our people are focused on accelerating our clients' businesses through the power of collaboration. We believe in the power of technology responsibly used to help people, partners and the planet.In a world where technology never stands still, we understand that, dedication to our clients success, innovation that matters, and trust and personal responsibility in all our relationships, lives in what we do as IBMers as we strive to be the catalyst that makes the world work better.Being an IBMer means you'll be able to learn and develop yourself and your career, you'll be encouraged to be courageous and experiment everyday, all whilst having continuous trust and support in an environment where everyone can thrive whatever their personal or professional background.Our IBMers are growth minded, always staying curious, open to feedback and learning new information and skills to constantly transform themselves and our company. They are trusted to provide on-going feedback to help other IBMers grow, as well as collaborate with colleagues keeping in mind a team focused approach to include different perspectives to drive exceptional outcomes for our customers. The courage our IBMers have to make critical decisions everyday is essential to IBM becoming the catalyst for progress, always embracing challenges with resources they have to hand, a can-do attitude and always striving for an outcome focused approach within everything that they do.### OTHER RELEVANT JOB DETAILSFor additional information about location requirements, please discuss with the recruiter following submission of your application.Position typeProfessionalNo