Security Delivery Consultant

As a Security Delivery Specialist, you will act as a subject-matter expert across Security Operations, Incident Response, SIEM, Endpoint Detection and Response, and Network Detection and Response. You will lead complex security investigations, enhance detection capabilities, administer critical security platforms and guide team members in delivering effective cybersecurity operations. You will work with security engineering, infrastructure, network and business stakeholders to continuously improve cyber defense processes, technologies and reporting. What You’ll Do Incident Response & SOC Operations • Develop, maintain and continuously improve Incident Response plans, SOC policies, processes, procedures and operational playbooks. • Lead the detection, triage, investigation, containment and response to complex cybersecurity events and incidents. • Analyze security events and telemetry to determine their nature, scope, severity and potential business impact. • Provide technical direction and guidance to team members throughout investigations and response activities. • Coordinate escalations and ensure incidents are handled according to established procedures and service requirements. • Participate in on-call and after-hours security support when required. • Identify lessons learned from security incidents and translate them into improvements across people, process and technology. SIEM & Detection Engineering • Work closely with SIEM engineers and other cybersecurity teams to develop, refine and optimize security-monitoring use cases. • Create and tune correlation and detection rules using telemetry from SIEM, EDR, NDR and other security technologies. • Analyze alerts, logs and security events to identify malicious activity, behavioral anomalies and emerging threats. • Review existing detection logic and recommend improvements to increase detection effectiveness and reduce false positives. • Identify monitoring gaps and support the development of new detection scenarios. • Support the integration of EDR, NDR and other security platforms with enterprise SIEM technologies. EDR Administration • Administer and optimize enterprise Endpoint Detection and Response technologies. • Deploy, upgrade and maintain EDR agents across Windows, macOS and Linux environments. • Monitor agent health, coverage and connectivity, and troubleshoot endpoints that are not reporting correctly. • Develop, implement and maintain EDR policies and configurations. • Integrate EDR platforms with SIEM and other cybersecurity technologies. • Review EDR configurations periodically and recommend enhancements to improve endpoint security coverage and detection capabilities. • Manage platform-related support tickets and coordinate with technology vendors through resolution. NDR Administration • Administer and optimize enterprise Network Detection and Response technologies. • Develop, implement and maintain NDR policies, configurations and monitoring rules. • Integrate NDR platforms with SIEM and the broader security technology ecosystem. • Develop and maintain custom correlation rules using EDR, NDR and other security telemetry. • Monitor platform health and troubleshoot technical, connectivity and reporting issues. • Periodically assess existing NDR configurations and recommend improvements to enhance network visibility and threat detection. • Manage technical support cases with NDR vendors and follow identified issues through to resolution. Cyber Intelligence, Reporting & Leadership • Produce clear, actionable cyber intelligence, incident and operational reports. • Communicate technical findings, security risks, business impact and recommended actions to varied audiences. • Present complex cybersecurity matters clearly to information security teams, non-technical business representatives and senior management. • Provide technical leadership, coaching and knowledge-sharing to cybersecurity team members. • Collaborate across SOC, security engineering, infrastructure, network, application and business teams. • Support continuous improvement initiatives that strengthen the overall maturity and effectiveness of security operations. What You’ll Need • Strong experience in Security Operations and Incident Response. • Demonstrated experience developing or maintaining Incident Response plans, SOC policies, processes, procedures and playbooks. • Hands-on experience using security tools and technologies for detection, investigation and resp

Strong experience in Security Operations and Incident Response. Demonstrated experience developing or maintaining Incident Response plans, SOC policies, processes, procedures and playbooks. Hands-on experience using security tools and technologies for detection, investigation and response.

Incident Response & SOC Operations: Develop, maintain and continuously improve Incident Response plans, SOC policies, processes, procedures and operational playbooks. Lead the detection, triage, investigation, containment and response to complex cybersecurity events and incidents. Analyze security events and telemetry to determine their nature, scope, severity and potential business impact. Provide technical direction and guidance to team members throughout investigations and response activities. Coordinate escalations and ensure incidents are handled according to established procedures and service requirements. Participate in on-call and after-hours security support when required. Identify lessons learned from security incidents and translate them into improvements across people, process and technology. SIEM & Detection Engineering: Work closely with SIEM engineers and other cybersecurity teams to develop, refine and optimize security-monitoring use cases. Create and tune correlation and detection rules using telemetry from SIEM, EDR, NDR and other security technologies. Analyze alerts, logs and security events to identify malicious activity, behavioral anomalies and emerging threats. Review existing detection logic and recommend improvements to increase detection effectiveness and reduce false positives. Identify monitoring gaps and support the development of new detection scenarios. Support the integration of EDR, NDR and other security platforms with enterprise SIEM technologies. EDR Administration: Administer and optimize enterprise Endpoint Detection and Response technologies. Deploy, upgrade and maintain EDR agents across Windows, macOS and Linux environments. Monitor agent health, coverage and connectivity, and troubleshoot endpoints that are not reporting correctly. Develop, implement and maintain EDR policies and configurations. Integrate EDR platforms with SIEM and other cybersecurity technologies. Review EDR configurations periodically and recommend enhancements to improve endpoint security coverage and detection capabilities. Manage platform-related support tickets and coordinate with technology vendors through resolution. NDR Administration: Administer and optimize enterprise Network Detection and Response technologies. Develop, implement and maintain NDR policies, configurations and monitoring rules. Integrate NDR platforms with SIEM and the broader security technology ecosystem. Develop and maintain custom correlation rules using EDR, NDR and other security telemetry. Monitor platform health and troubleshoot technical, connectivity and reporting issues. Periodically assess existing NDR configurations and recommend improvements to enhance network visibility and threat detection. Manage technical support cases with NDR vendors and follow identified issues through to resolution. Cyber Intelligence, Reporting & Leadership: Produce clear, actionable cyber intelligence, incident and operational reports. Communicate technical findings, security risks, business impact and recommended actions to varied audiences. Present complex cybersecurity matters clearly to information security teams, non-technical business representatives and senior management. Provide technical leadership, coaching and knowledge-sharing to cybersecurity team members. Collaborate across SOC, security engineering, infrastructure, network, application and business teams. Support continuous improvement initiatives that strengthen the overall maturity and effectiveness of security operations.