Security Incident Response Lead

International Business Machines Corporation; Bogotá; On-site; COP 60,000,000 - 120,000,000; Full time

Job summary

IBM Consulting in Bogotá is seeking a Technical or Security Consultant specializing in Intelligence & Operations to help clients address security exposures and vulnerabilities. You will lead end-to-end incident response activities and perform advanced investigations across Windows, Linux, and cloud environments.

The role requires 3+ years in incident response/DFIR, hands-on ransomware/APT experience, and strong knowledge of EDR/XDR and SIEM.

Qualifications

• 3+ years in incident response, DFIR, or CSIRT roles handling advanced threats.
• Hands-on experience with ransomware, APTs, intrusions, and insider threats.
• Strong skills with EDR/XDR platforms and SIEM analytics.
• Practical digital forensics knowledge: Velociraptor, FTK, EnCase, Autopsy, Volatility.

Responsibilities

• Lead end-to-end security incident response activities from detection to containment, eradication, and recovery.
• Participate directly in ransomware, intrusions, APT activity, and insider threat incidents.
• Perform advanced investigations using EDR/XDR, SIEM data, and forensic artifacts.
• Conduct digital forensics on endpoints and servers (memory, disk, system artifacts).
• Perform root cause analysis (RCA) and determine scope and impact of incidents.
• Investigate adversary behavior using MITRE ATT&CK and map TTPs to activity.
• Correlate logs and events using SIEM to support investigations.
• Coordinate response efforts with SOC, IT, Legal, and business teams.
• Develop, maintain CSIRT playbooks and response procedures.
• Produce forensic documentation and post-incident reports.

Skills

Incident response

DFIR

CSIRT

EDR/XDR

Digital forensics

SIEM analytics

Windows / Linux

MITRE ATT&CK

Security frameworks

Cloud (Azure/AWS)

English (Intermediate)

Tools

Velociraptor

FTK

EnCase

Autopsy

Volatility

Microsoft Defender

CrowdStrike

SentinelOne

Cortex XDR

SIEM platforms

Job description

IBM Consulting in Bogotá is seeking a Technical or Security Consultant specializing in Intelligence & Operations to help clients address security exposures and vulnerabilities. You will lead end-to-end incident response activities and perform advanced investigations across Windows, Linux, and cloud environments.

The role requires 3+ years in incident response/DFIR, hands-on ransomware/APT experience, and strong knowledge of EDR/XDR and SIEM.