Technical Consultant – Incident Handler

About the role

IBM Consulting is looking for a Technical Consultant specialized in Threat Detection Response & Intelligence to protect client digital infrastructures. You will lead end‑to‑end security incident response, work with cutting‑edge cybersecurity tools, and collaborate with cross‑functional teams during high‑impact incidents.

Key responsibilities

• Lead and execute full incident response cycles, from detection through containment, eradication and recovery.
• Investigate ransomware, APT, intrusion and insider‑threat incidents using EDR/XDR telemetry, SIEM data and forensic artifacts.
• Perform digital forensics on endpoints and servers, including memory, disk and system‑artifact analysis.
• Conduct root‑cause analysis, map adversary behavior with MITRE ATT&CK and produce post‑incident reports.
• Coordinate technical response with SOC, IT, Legal and business teams and maintain CSIRT playbooks.

Required profile

• 3+ years of experience in incident response, DFIR or CSIRT roles handling advanced threats.
• Relevant certifications such as GCIH, GCED, GCFA, SC‑200 or vendor‑specific DFIR/EDR certifications.
• Intermediate English proficiency for technical reading and communication.

Required skills

• Hands‑on experience with EDR/XDR platforms (Microsoft Defender, CrowdStrike, SentinelOne, Cortex XDR).
• Proficiency with DFIR tools (Velociraptor, FTK, EnCase, Autopsy, Volatility).
• Strong log analysis and event correlation using SIEM technologies.
• Solid knowledge of Windows, Linux and Active Directory environments.
• Experience with MITRE ATT&CK investigations and NIST incident‑response frameworks (SP 800‑61, CSF, ISO/IEC 27035).
• Basic familiarity with cloud platforms Azure and AWS.