Cyber Security Consultant - Threat Management (UK Public Sector)

IBM; Leicester; Hybrid; GBP 90,000 - 130,000; Full time

Benefits offered by this job

25 days holiday

Private medical insurance

Dental & optical cover

Employee Assistance Program

Group pension plan

Flexible working

Job summary

IBM Consulting UK FutureNow seeks a Senior Security Consultant - Threat Management to strengthen clients’ Security Operations, Detection & Response, and Threat Management across cloud, hybrid, and on-prem environments. You will design detection strategies, tune analytics, and enhance SIEM/SOAR capabilities while delivering advisory and engineering engagements with client teams.

Role requires hands-on security engineering, with experience across major SIEM platforms, threat hunting, incident

Qualifications

• Hands-on experience with major SIEM platforms (Microsoft Sentinel, Splunk, QRadar, Elastic, Chronicle, LogRhythm).
• Experience delivering SOC transformation, SOC uplift, or Security Operations improvement programmes.
• Strong knowledge of MITRE ATT&CK and threat-informed defence principles.
• Experience supporting or leading incident investigation and response activities.

Responsibilities

• Designing, implementing, and improving SIEM and security monitoring capabilities.
• Developing and tuning detection content, analytics rules, and correlation logic.
• Conducting threat hunting exercises aligned to MITRE ATT&CK and client threat profiles.
• Supporting incident response, investigation, and post-incident improvement activities.
• Delivering SOC maturity assessments, capability reviews, and uplift roadmaps.
• Integrating telemetry across cloud, identity, endpoint, network, and application environments.
• Designing and improving SOAR playbooks and automated response workflows.
• Advising clients on detection engineering standards, operational processes, and security monitoring strategy.
• Producing technical documentation, runbooks, and client deliverables.

Skills

Threat Management

Detection Engineering

Security Operations

Incident Response

Threat Hunting

MITRE ATT&CK

Cloud security monitoring

EDR/XDR telemetry

KQL

SPL

Python

PowerShell

Stakeholder communication

Tools

Microsoft Sentinel

Splunk

QRadar

Elastic

Chronicle

LogRhythm

Job description

As a Senior Security Consultant - Threat Management, you will help clients strengthen and modernise their Security Operations, Detection & Response, and Threat Management capabilities across cloud, hybrid, and on-premise environments. Working closely with client security teams, architects, and operational stakeholders, you will design and improve detection strategies, develop high-quality detection content, enhance SIEM/SOAR capabilities, and drive measurable security outcomes through threat-informed defence. You will operate as a trusted technical consultant, combining hands‑on expertise with strong stakeholder engagement to deliver client‑facing advisory, engineering, and transformation engagements.,

• Designing, implementing, and improving SIEM and security monitoring capabilities.
• Developing and tuning detection content, analytics rules, and correlation logic.
• Conducting threat hunting exercises aligned to MITRE ATT&CK and client threat profiles.
• Supporting incident response, investigation, and post-incident improvement activities.
• Delivering SOC maturity assessments, capability reviews, and uplift roadmaps.
• Integrating and optimising telemetry across cloud, identity, endpoint, network, and application environments.
• Designing and improving SOAR playbooks and automated response workflows.
• Advising clients on detection engineering standards, operational processes, and security monitoring strategy.
• Producing high-quality technical documentation, runbooks, operating procedures, and client deliverables.
• Leading workshops and presenting findings to both technical and non-technical stakeholders.
  Demonstrable experience within Threat Management, Detection Engineering, Security Operations, Incident Response, or Threat Hunting environments.
• Hands-on experience with one or more major SIEM platforms such as:
• Microsoft Sentinel
• Splunk
• QRadar
• Elastic
• Chronicle
• LogRhythm Experience developing detection logic, analytics rules, use cases, and threat hunting content.
• Strong understanding of MITRE ATT&CK and threat-informed defence principles.
• Experience supporting or leading incident investigation and response activities.
• Knowledge of cloud security monitoring across Azure, AWS, or GCP environments.
• Experience working with EDR/XDR technologies and associated telemetry.
• Proficiency in KQL, SPL, Python, PowerShell, or equivalent security-focused query/scripting languages.
• Ability to communicate effectively with both technical and business stakeholders.
• Experience operating within regulated environments such as public sector, financial services, healthcare, telecommunications, or critical national infrastructure.
• Preferred technical and professional experience
• Previous consulting or client-facing delivery experience.
• Experience delivering SOC transformation, SOC uplift, or Security Operations improvement programmes.
• Experience building, tuning, or optimising SOAR capabilities and automated response workflows.
• Experience conducting threat-led assessments, purple team exercises, or threat modelling activities.
• Experience with threat intelligence integration, enrichment pipelines, and intelligence-led detection development.
• Exposure to cloud-native security services such as:
• Microsoft Defender XDR
• Microsoft Sentinel
• AWS GuardDuty
• AWS Security Hub
• Google Security Operations Experience designing SIEM onboarding strategies, data normalisation approaches, or detection engineering frameworks.
• Understanding of detection-as-code, CI/CD pipelines, or modern security engineering practices.
• Relevant industry certifications such as:
• SC-200
• AZ-500
• GCIH
• GCIA
• GCDA
• Splunk ES certifications
• Microsoft Security certifications Experience leading technical workshops, mentoring junior consultants, or shaping client security roadmaps.

IBM is committed to creating a diverse environment and is proud to be an equal-opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, gender, gender identity or expression, sexual orientation, national origin, caste, genetics, pregnancy, disability, neurodivergence, age, veteran status, or other characteristics. IBM is also committed to compliance with all fair employment practices regarding citizenship and immigration status.

At IBM Consulting UK FutureNow, you'll build a career at the forefront of hybrid cloud and AI, working with leading clients across the public and private sectors. You'll collaborate with top industry professionals, gain hands on experience with cutting edge technologies, and deliver solutions that create real business impact. From day one, you'll work on meaningful, high profile programmes that stretch your skills and accelerate your growth. We invest heavily in you--supporting continuous learning, in demand skills development, and long term career progression. You'll thrive in a flexible, inclusive environment that values curiosity, encourages reinvention, and recognises what makes you unique.

• Tools and policies to support your work-life balance from flexible working approaches, sabbatical programs, paid paternity leave, maternity leave and an innovative maternity returners scheme
• More traditional benefits, such as 25 days holiday (in addition to public holidays), private medical, dental & optical cover, online shopping discounts, an Employee Assistance Program, life assurance and a group pension plan through salary sacrifice.