Security & Threat Intel Consultant – Incident Response Pro

IBM; Bogotá; On-site; COP 80,000,000 - 140,000,000; Full time

Job summary

IBM Consulting in Bogotá is seeking a Technical or Security Consultant specializing in Intelligence & Operations to help clients address security issues and vulnerabilities. You will lead end-to-end incident response, investigations, and forensic activities across Windows, Linux, and AD environments, coordinating with SOC, Legal, and business teams.

The role requires 3+ years in incident response/DFIR/CSIRT, hands-on ransomware/APT experience, and strong SIEM/EDR/XDR skills; cloud basics with

Qualifications

• 3+ years of incident response, DFIR or CSIRT experience.
• Hands-on ransomware, APT, intrusion investigations.
• Experience with EDR/XDR platforms (Microsoft Defender, CrowdStrike, SentinelOne, Cortex XDR).
• Forensics tools knowledge: Velociraptor, FTK, EnCase, Autopsy, Volatility.
• SIEM log analysis and event correlation.
• Windows, Linux, and Active Directory environments.
• MITRE ATT&CK-based investigations and TTP analysis.
• NIST CSF/800-61 ISO/IEC 27035 familiarity.
• Basic cloud experience (Azure, AWS).
• Ability to work under pressure during high-impact security incidents.

Responsibilities

• Lead and execute end-to-end security incident response activities.
• Participate in critical security incidents including ransomware and intrusions.
• Perform advanced investigations using EDR/XDR, SIEM data, and forensics artifacts.
• Conduct endpoint and server forensics (memory, disk, system artifacts).
• Carry out RCA and determine scope and impact of incidents.
• Investigate adversary behavior using MITRE ATT&CK and map TTPs.
• Correlate logs and events with SIEM platforms to support investigations.
• Coordinate response with SOC, IT, Legal and business teams.
• Develop and maintain CSIRT playbooks and response procedures.
• Produce post-incident reports with timelines and remediation recommendations.

Skills

Incident response

DFIR

CSIRT

MITRE ATT&CK

SIEM

Cloud basics

Tools

Microsoft Defender

CrowdStrike

SentinelOne

Cortex XDR

Velociraptor

FTK

EnCase

Autopsy

Volatility

Job description

IBM Consulting in Bogotá is seeking a Technical or Security Consultant specializing in Intelligence & Operations to help clients address security issues and vulnerabilities. You will lead end-to-end incident response, investigations, and forensic activities across Windows, Linux, and AD environments, coordinating with SOC, Legal, and business teams.

The role requires 3+ years in incident response/DFIR/CSIRT, hands-on ransomware/APT experience, and strong SIEM/EDR/XDR skills; cloud basics with