Security Specialist - STUDENT CONVERSION

**Introduction** A career in IBM Consulting is built on long-term client relationships and close collaboration worldwide. You’ll work with leading companies across industries, helping them shape their hybrid cloud and AI journeys. With support from our strategic partners, robust IBM technology, and Red Hat, you’ll have the tools to drive meaningful change and accelerate client impact. At IBM Consulting, curiosity fuels success. You’ll be encouraged to challenge the norm, explore new ideas, and create innovative solutions that deliver real results. Our culture of growth and empathy focuses on your long-term career development while valuing your unique skills and experiences. **Your role and responsibilities** 1. Continuous Security Monitoring * Monitor security tools (SIEM, EDR, IDS/IPS, firewalls) 24/7 * Analyze alerts and events to identify potential threats * Correlate logs from multiple sources (servers, endpoints, network devices, cloud) ------------------------- 2. Incident Detection & Analysis * Investigate suspicious activity and determine severity * Perform initial triage of security alerts * Identify false positives vs real incidents * Classify incidents based on impact and urgency ------------------------- 3. Incident Response & Containment * Execute predefined incident response procedures * Contain threats (e.g., isolate endpoints, block IPs, disable accounts) * Support eradication and recovery efforts * Escalate complex incidents to higher-level teams (L2/L3, IR team) ------------------------- 4. Threat Intelligence & Awareness * Utilize threat intelligence feeds and indicators of compromise (IOCs) * Stay updated on emerging threats, vulnerabilities, and attack techniques * Map threats using frameworks like MITRE ATT&CK ------------------------- 5. Ticketing & Case Management * Create and manage incident tickets in tracking systems * Document investigations, findings, and actions taken * Ensure proper closure with complete audit trail ------------------------- 6. Playbook Execution & Process Adherence * Follow SOC playbooks and standard operating procedures (SOPs) * Suggest improvements based on incident trends * Ensure compliance with security policies and SLAs ------------------------- 7. Collaboration & Escalation * Work with cross-functional teams (IT, network, cloud, application teams) * Coordinate with stakeholders during major incidents * Escalate incidents according to severity and timelines ------------------------- 8. Vulnerability & Risk Support * Assist in vulnerability monitoring and reporting * Validate vulnerabilities through alerts or scanning tools * Support patching prioritization (in coordination with IT teams) ------------------------- 9. Reporting & Metrics * Generate daily/weekly security reports * Track KPIs such as: * Mean Time to Detect (MTTD) * Mean Time to Respond (MTTR) * Incident volumes and trends ------------------------- 10. Compliance & Audit Support * Ensure adherence to security frameworks (ISO 27001, NIST, etc.) * Support audits by providing incident logs and evidence * Maintain documentation aligned to regulatory requirements **Required technical and professional expertise** 1. Technical Expertise ? Security Monitoring & Analysis * Proficiency in Security Information and Event Management (SIEM) tools (e.g., Splunk, IBM QRadar, Microsoft Sentinel) * Ability to analyze logs from: * Network devices (firewalls, routers, IDS/IPS) * Endpoints and servers * Cloud platforms * Strong understanding of event correlation and alert triage ------------------------- ? Networking & Systems Knowledge * Solid understanding of: * TCP/IP, DNS, DHCP, HTTP/HTTPS * Network traffic analysis (packet inspection basics) * Familiarity with operating systems: * Windows (Active Directory, Event Logs) * Linux (syslogs, permissions, processes) ------------------------- ?️ Threat Detection & Incident Response * Knowledge of incident response lifecycle: * Preparation, Identification, Containment, Eradication, Recovery * Ability to: * Investigate suspicious activities * Identify Indicators of Compromise (IOCs) * Perform root cause analysis ------------------------- ? Threat Intelligence & Frameworks * Understanding of: * MITRE ATT&CK framework * Cyber kill chain concepts * Experience using threat intelligence sources and tools * Ability to map observed behavior to known attack techniques ------------------------- ? Endpoint & Security Tools * Hands-on experience with: * EDR/XDR tools (e.g., CrowdStrike, Microsoft Defender) * Antivirus and endpoint protection platforms * Understanding of malware behaviors and detection methods ------------------------- ⚙️ Automation & Scripting (Preferred) * Basic scripting skills for automation and investigation: * Python, PowerShell, or Bash * Familiarity with SOAR tools is a plus ------------------------- ☁️ Cloud Security (Increasingly Required) * Basic understanding of cloud environments: * AWS, Azure, GCP * Knowledge of: * Cloud logging (CloudTrail, Azure Monitor) * Identity and access management (IAM) * Cloud security posture concepts **Preferred technical and professional experience** • Familiarity with Cloud Security: Exposure to cloud security principles, architecture, and compliance, including cloud-based security solutions and technologies. • Knowledge of Containerization: Understanding of containerization concepts, including Docker, Kubernetes, and container orchestration. • Experience with Agile Methodologies: Exposure to Agile development methodologies, including Scrum, Kanban, and Lean software development. IBM is committed to creating a diverse environment and is proud to be an equal-opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, gender, gender identity or expression, sexual orientation, national origin, caste, genetics, pregnancy, disability, neurodivergence, age, veteran status, or other characteristics. IBM is also committed to compliance with all fair employment practices regarding citizenship and immigration status.