Technical Consultant-Threat Detection Content & Administration

International Business Machines Corporation; Bengaluru; On-site; INR 1,800,000 - 3,200,000; Full time

Job summary

International Business Machines Corporation seeks a Technical Consultant in Threat Detection Content & Administration to manage security technology infrastructure, including SIEM, SOAR, EDR, AV, and Cloud security controls. You will develop use cases, rules, and policies to ensure efficient infrastructure functionality.

Your role involves deploying use cases, tuning rules, maintaining patched systems, and applying MITRE ATT&CK and NIST frameworks to assess risks and improve threat detection and

Qualifications

• Experience with security infrastructure (SIEM, SOAR, EDR)
• Knowledge of cloud security controls and threat detection

Responsibilities

• Develop use cases and rules to identify malicious activity and deploy to client environments.
• Maintain and upgrade security infrastructure, ensuring patched and efficient operation.
• Apply MITRE ATT&CK and NIST frameworks to classify threats and assess risk.
• Deliver security policy recommendations based on threat analysis.
• Continuously monitor and optimize security controls for effective detection and response.

Job description

As a Technical Consultant in Threat Detection Content & Administration, you will manage and maintain security technology infrastructure, including SIEM, SOAR, EDR, AV, and Cloud security controls. You will develop and deploy use cases, rules, and security policy recommendations to ensure efficient infrastructure functionality.

Your primary responsibilities will include:

• Develop Use Cases and Rules: Create and tune use cases, rules, and optimization reports to identify malicious activity, and deploy them to the client environment. This involves analyzing system and network activity, indicators of compromise, and attacker tactics.
• Maintain Infrastructure: Ensure that security infrastructures are patched, upgraded, and functioning efficiently, utilizing expertise in Security Incident & Event Management (SIEM), Endpoint Detection and Response technology, and network security technologies.
• Apply Threat Frameworks: Utilize the MITRE ATT&CK framework to classify attacks, identify attack attribution, and assess risk, as well as the NIST Cybersecurity framework to evaluate the risk of threats.
• Deliver Security Policy Recommendations: Provide security policy recommendations to clients based on expertise in security technologies and threat analysis.
• Optimize Security Controls: Continuously monitor and optimize security controls to ensure efficient and effective threat detection and response.