Technical Consultant-Threat Detection Content & Administration

International Business Machines Corporation; Mumbai; On-site; INR 1,400,000 - 2,600,000; Full time

Job summary

International Business Machines Corporation in Mumbai seeks a Technical Consultant to manage security technology infrastructure, including SIEM, SOAR, EDR, AV, and cloud controls. You will develop and deploy use cases, rules, and policy recommendations to ensure efficient infrastructure functionality.

You will analyze system activity, apply MITRE ATT&CK, develop security policies, tune controls, and evaluate risks using the NIST framework to mitigate threats.

Responsibilities

• Manage security infrastructure: patching, upgrades, and deployment of use cases and run books.
• Analyze system activity and attacker techniques using MITRE ATT&CK to classify threats.
• Develop security policy based on SIEM, EDR, anti-malware, and logging practices.
• Tune and optimize security controls (SIEM, SOAR, EDR, AV, cloud) for detection and response.
• Evaluate threat risk using the NIST Cybersecurity framework and provide mitigation recommendations.

Job description

As a Technical Consultant in Threat Detection Content & Administration, you will manage and maintain security technology infrastructure, including SIEM, SOAR, EDR, AV, and Cloud security controls. You will develop and deploy use cases, rules, and security policy recommendations to ensure efficient infrastructure functionality.

Your primary responsibilities will include:

• Manage Security Infrastructure: Manage and maintain security technology infrastructure, ensuring that systems are patched, upgraded, and functioning efficiently. This includes developing use cases, rules, and run books, and deploying them to the client environment.
• Analyze System Activity: Analyze and translate system and network activity, indicators of compromise, and attacker tactics to identify malicious activity, applying the MITRE ATT&CK framework to classify attacks and assess risk.
• Develop Security Policy: Develop and recommend security policy based on expertise in Security Incident & Event Management (SIEM), Endpoint Detection and Response technology, anti-malware, anti-spam, network security technologies, and general user and network activity logging policies.
• Optimize Security Controls: Tune and optimize security controls, including SIEM, SOAR, EDR, AV, and Cloud security controls, to ensure efficient threat detection and response.
• Evaluate Risk: Evaluate the risk of threats using the NIST Cybersecurity framework and provide recommendations to mitigate identified risks.