Cybersecurity Senior Consultant - EY GDS Spain

EY; Málaga; On-site; EUR 70,000 - 90,000; Full time

Job summary

EY GDS Spain is seeking a Cybersecurity Senior Consultant to join the Cyber Detection & Response (CDR) team in Malaga. You will contribute to security monitoring, detection engineering, and incident response across diverse client environments, applying AI-enabled capabilities and building scalable defense capabilities.

The role involves SIEM/SOAR/EDR/XDR configurations, detection use-case development, log onboarding, and governance design.

Qualifications

• Experience in cybersecurity detection and response across SOC/CSIRT.
• Hands-on experience with at least one enterprise security monitoring platform.
• Professional proficiency in English.

Responsibilities

• Deliver technical and advisory activities across CDR projects.
• Apply AI-enabled security capabilities to support detection engineering and response workflows.
• Develop and tune detection use cases based on threats and telemetry.
• Support log-source onboarding, data parsing, and security-tool integrations.
• Develop or improve detection and response policies, procedures, and playbooks.
• Translate requirements into practical solutions and client deliverables.
• Facilitate technical discussions with client and internal teams.
• Provide technical guidance to less experienced team members.

Skills

Cybersecurity

Detection & Response

SIEM

Incident response

English

Tools

SIEM platforms

EDR/XDR platforms

Job description

Cybersecurity Senior Consultant - EY GDS Spain

Location: Malaga

Other locations: Primary Location Only

Cybersecurity Senior Consultant - Cyber Detection & Response

We are delighted to invite you to join the Cybersecurity Detection & Response (CDR) team within EY GDS Poland Consulting Services. The role focuses on helping clients develop and improve their security monitoring, detection, and response capabilities across different technologies and operating environments.

You will work in a dynamic consulting environment where assignments vary based on client needs. Your work may include SIEM engineering, detection development, log-source onboarding, security integrations, incident response processes, playbooks, governance, operating model definition, and security operations improvement.

The opportunity

As part of the CDR team, you will contribute to projects that vary in scope, technology, and complexity. Depending on the engagement, you may perform technical implementation, capability assessment, process and governance design, operational documentation, or broader transformation activities. We are looking for professionals with practical experience across multiple CDR areas who can adapt their knowledge to new technologies, client environments, and assignments.

Your key responsibilities

• Deliver technical and advisory activities across CDR projects.
• Apply AI-enabled security capabilities to support detection engineering, alert analysis, investigations, response workflows, and security operations improvement.
• Develop and tune detection use cases based on relevant threats, risks, and available security telemetry.
• Support log-source onboarding, data parsing and normalization, security-tool integration, and SIEM improvement.
• Develop or improve detection and response policies, procedures, processes and playbooks.
• Assess detection and response capabilities and define practical improvements across people, process, technology, organization aspects.
• Configure or support SIEM, SOAR, EDR, XDR, and related security technologies.
• Translate technical and operational requirements into practical solutions and clear client deliverables.
• Facilitate technical discussions and working sessions with client and internal teams.
• Provide technical guidance and knowledge sharing to less experienced team members.

Skills and attributes for success

To qualify for the role, you must have

• Professional experience in cybersecurity detection and response, security operations, or incident response.
• Practical experience across multiple CDR areas, such as SIEM engineering, detection development, log management, security automation, incident response, or SOC and CSIRT improvement.
• Hands-on experience with at least one enterprise security monitoring, detection, and response platform.
• Practical understanding of AI applications within CDR, such detection development, alert analysis, investigation, automation, or security operations improvement.
• Understanding of detection use-case development, security telemetry, and the security-data lifecycle.
• Ability to analyze technical and operational requirements and translate them into practical solutions.
• Ability to develop clear technical documentation, operational procedures, or playbooks.
• Strong analytical, problem-solving, and communication skills.
• Ability to work independently, adapt to different assignments, and manage defined project responsibilities.
• Professional proficiency in English.

Ideally, you’ll also have

• Experience with Microsoft Sentinel, Splunk, or another enterprise SIEM platform.
• Knowledge of Microsoft Defender, CrowdStrike, or another EDR or XDR platform.
• Experience with SOAR, security workflow automation, or security-tool integrations.
• Working knowledge of KQL, SPL, PowerShell, Python, or similar languages.
• Experience using AI-enabled capabilities within SIEM, SOAR, EDR, XDR, or related cybersecurity platforms.
• Familiarity with MITRE ATT&CK and established incident response methodologies.
• Exposure to CDR assessments, governance, operating models, service development, or capability transformation.
• Experience with cloud security monitoring across Microsoft Azure, AWS, or Google Cloud.
• Relevant cybersecurity or technology certifications.

Select how often (in days) to receive an alert:

EY refers to the global organization, and may refer to one or more, of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients.