Technical Consultant-Threat Detection Response & Intelligence

IBM; Boston (MA); On-site; USD 120,000 - 170,000; Full time

Job summary

IBM in Boston is seeking a Technical Consultant focusing on Threat Detection, Response & Intelligence to safeguard client networks by identifying, analyzing, and mitigating cyber threats using a broad set of security tools.

You will investigate incidents with SIEM, SOAR, EDR, and XDR, apply MITRE ATT&CK and Cyber Kill Chain to counter adversaries, prioritize incident reports, and analyze Windows, macOS, and Linux logs to identify threats.

Qualifications

• Experience investigating security incidents using SIEM, SOAR, EDR and XDR platforms.
• Familiarity with MITRE ATT&CK framework and Cyber Kill Chain.
• Experience analyzing Windows, macOS and Linux logs.

Responsibilities

• Conduct Event Investigations using SIEM, SOAR, EDR, and XDR platforms.
• Manage Incident Reports with actionable recommendations.
• Analyze Network and Endpoint Events from Windows, MAC, and Linux systems.
• Engage in Vulnerability Management and cyber threat intelligence activities.
• Provide actionable recommendations to clients to enhance security posture.

Skills

SIEM

SOAR

EDR

XDR

MITRE ATT&CK

Cyber Kill Chain

Threat Analysis

Tools

Windows

macOS

Linux

Job description

As a Technical Consultant: Threat Detection Response & Intelligence, you play a vital role in safeguarding an organization's digital infrastructure by identifying, analyzing, and mitigating cyber threats. This position involves using a variety of cybersecurity tools to monitor, prioritize, investigate, and respond to security incidents.

Your primary responsibilities will include:

• Conduct Event Investigations: Investigate security incidents using SIEM, SOAR, EDR, and XDR platforms, and apply industry frameworks like MITRE ATT&CK and the Cyber Kill Chain to understand and counter adversary tactics effectively.
• Manage Incident Reports: Prioritize and manage incident reports, providing actionable recommendations and responses to strengthen the client's security posture.
• Analyze Network and Endpoint Events: Interpret security tools and logs from Windows, MAC, and Linux systems to identify potential threats.
• Engage in Vulnerability Management: Participate in vulnerability management and cyber threat intelligence activities to identify and anticipate potential threats.
• Provide Actionable Recommendations: Deliver recommendations and responses to clients to enhance their security posture.