Security Delivery Consultant

Role overview

Incident response and SOC operations

• Develop, maintain and improve incident response plans, SOC policies, processes, procedures and operational playbooks.
• Lead detection, investigation, containment and response to cybersecurity events and incidents.
• Analyze security events and provide technical guidance to analysts and security team members.
• Support continuous maturity of Cybersecurity Operations Center processes and provide technical leadership during complex incidents and escalations.
• Participate in on-call and after-hours security support when required.

SIEM and detection engineering

• Develop, refine and optimize security correlation rules with SIEM engineers and cybersecurity teams.
• Analyze security telemetry and events to identify suspicious activity, attack patterns and potential threats.
• Develop and tune detection rules using SIEM, EDR and NDR telemetry.
• Improve detection coverage and monitoring effectiveness, including integrating endpoint and network technologies with enterprise SIEM platforms.

EDR and NDR administration

• Administer and optimize EDR technologies; deploy, upgrade and maintain agents across Windows, macOS and Linux.
• Monitor endpoint agent health, troubleshoot reporting issues, and maintain EDR policies and configurations.
• Integrate EDR with SIEM and other cybersecurity platforms, review configurations, and coordinate vendor support cases.
• Administer NDR technologies, maintain policies and configurations, integrate with SIEM, and troubleshoot platform issues through resolution.

Cyber intelligence and team leadership

• Produce actionable cyber intelligence and security reports communicating technical findings, risks and recommendations.
• Explain complex security issues to technical practitioners, non-technical business stakeholders and senior management.
• Provide technical leadership, coaching and guidance to cybersecurity team members.
• Collaborate across SOC, infrastructure, network, application and broader security teams.

What you'll need

• Strong experience in Security Operations and Incident Response, including incident response plans and SOC policies, procedures and processes.
• Strong hands-on SIEM experience and experience developing, tuning or refining correlation and detection rules.
• Hands-on expertise administering EDR and NDR technologies and deploying endpoint security agents across Windows, macOS and Linux.
• Experience integrating EDR and NDR platforms with SIEM and other security technologies.
• Strong security-event analysis, investigation, detection and response knowledge, plus analytical, troubleshooting and organizational capabilities.
• Ability to lead teams technically and guide complex investigations; strong communication, documentation and reporting skills.
• Ability to participate in on-call or after-hours support when required.

Bonus qualifications

• GIAC Certified Incident Handler (GCIH), GIAC Continuous Monitoring Certification (GMON), GIAC Certified Forensic Analyst (GCFA), or equivalent recognized cybersecurity, SOC, digital forensics or incident response certification.
• Experience in large-scale enterprise Security Operations Centers.
• Exposure to threat hunting, cyber threat intelligence and detection engineering.
• Experience supporting complex or managed cybersecurity environments.