Security Delivery Consultant

About the Role

Key Responsibilities

• The Security Delivery Consultant will combine technical expertise with leadership and stakeholder management, guiding security teams through complex investigations and improving detection capabilities. Responsibilities include:
• Developing, maintaining, and improving Incident Response plans, SOC policies, processes, procedures, and operational playbooks.
• Leading and supporting the detection, investigation, containment, and response to cybersecurity events and incidents.
• Performing detailed analysis of security events and providing technical guidance to analysts.
• Providing technical leadership during complex incidents, investigations, and escalations.
• Participating in on-call and after-hours security support when required.
• SIEM and Detection Engineering
• Collaborating with SIEM engineers and cybersecurity teams to develop, refine, and optimize security correlation rules.
• Analyzing security telemetry and events to identify suspicious activity, attack patterns, and potential threats.
• Developing and tuning custom correlation and detection rules leveraging SIEM, EDR, and NDR telemetry.
• Identifying opportunities to enhance security detection coverage and monitoring effectiveness.
• Supporting the integration of endpoint, network, and other security technologies with enterprise SIEM platforms.
• EDR and NDR Administration
• Administering and optimizing enterprise Endpoint Detection and Response (EDR) technologies.
• Deploying, upgrading, and maintaining EDR agents across Windows, macOS, and Linux environments.
• Monitoring endpoint agent health and troubleshooting systems.
• Developing, maintaining, and optimizing EDR security policies and configurations.
• Administering and optimizing Network Detection and Response (NDR) technologies.
• Developing, maintaining, and enhancing NDR policies and configurations.
• Integrating NDR technologies with SIEM and the broader security technology ecosystem.
• Cyber Intelligence and Leadership
• Producing clear, actionable cyber intelligence and security reports communicating technical findings, risks, and recommendations.
• Translating complex security issues for audiences ranging from security practitioners to senior management.
• Providing technical leadership, coaching, and guidance to cybersecurity team members.
• Collaborating effectively across SOC, infrastructure, network, application, and broader security teams.

Qualifications and Experience

• Candidates should possess 5-10 years of relevant experience in cybersecurity. The role requires a strong technical background in Security Operations Center capabilities, including Incident Response, SIEM, EDR, and NDR. Experience in leading security teams and managing stakeholders is essential.