Security Incident Response Engineer & Forensics Lead

International Business Machines Corporation; Bogotá; On-site; COP 70,000,000 - 110,000,000; Full time

Job summary

IBM Consulting is seeking a seasoned Technical or Security Consultant specializing in Intelligence & Operations to drive advanced incident response programs. You will lead end-to-end investigations, perform forensics, and coordinate cross-functional teams to mitigate threats across client environments.

The role requires hands-on DFIR expertise, strong SIEM/EDR skills, and practical knowledge of Windows, Linux, and AD. A solid foundation in security frameworks and cloud basics is expected.

Qualifications

• 3+ years of experience in incident response, DFIR, or CSIRT roles.
• Hands-on in ransomware, APTs, intrusions, and insider threats.
• Experience with EDR/XDR platforms and SIEM tools.
• Knowledge of digital forensics and DFIR tools.
• Understanding of Windows, Linux, and AD environments.
• MITRE ATT&CK-based investigations experience.
• Knowledge of NIST/ISO incident response frameworks.
• Basic cloud experience (Azure/AWS).

Responsibilities

• Lead and execute end-to-end security incident response activities from detection to containment and recovery.
• Participate in critical security incidents including ransomware, intrusions, APTs, and insider threats.
• Perform advanced incident investigations using EDR/XDR, SIEM data, and forensic artifacts.
• Conduct digital forensics on endpoints/servers (memory, disk, system artifacts).
• Perform RCA to determine scope and impact of incidents.
• Correlate logs and events using SIEM to support investigations.
• Coordinate with SOC, IT, Legal, and business teams during incidents.
• Develop and maintain CSIRT playbooks and response procedures.
• Produce post-incident reports with timelines and remediation recommendations.

Skills

Incident response

DFIR

CSIRT

EDR/XDR

SIEM

Digital forensics

MITRE ATT&CK

Windows OS

Linux OS

Active Directory

Education

Bachelor's Degree

Tools

Microsoft Defender

CrowdStrike

SentinelOne

Cortex XDR

Job description

IBM Consulting is seeking a seasoned Technical or Security Consultant specializing in Intelligence & Operations to drive advanced incident response programs. You will lead end-to-end investigations, perform forensics, and coordinate cross-functional teams to mitigate threats across client environments.

The role requires hands-on DFIR expertise, strong SIEM/EDR skills, and practical knowledge of Windows, Linux, and AD. A solid foundation in security frameworks and cloud basics is expected.