Cyber Security Consultant - Threat Management (UK Public Sector)

At IBM Consulting UK FutureNow, you'll build a career at the forefront of hybrid cloud and AI, working with leading clients across the public and private sectors. You'll collaborate with top industry professionals, gain hands-on experience with cutting-edge technologies, and deliver solutions that create real business impact. From day one, you'll work on meaningful, high-profile programmes that stretch your skills and accelerate your growth.

We invest heavily in you—supporting continuous learning, in-demand skills development, and long-term career progression. You'll thrive in a flexible, inclusive environment that values curiosity, encourages reinvention, and recognises what makes you unique.

We offer:

• Tools and policies to support your work-life balance from flexible working approaches, sabbatical programs, paid paternity leave, maternity leave and an innovative maternity returners scheme
• More traditional benefits, such as 25 days holiday (in addition to public holidays), private medical, dental & optical cover, online shopping discounts, an Employee Assistance Program, life assurance and a group pension plan through salary sacrifice

Your role and responsibilities:

As a Senior Security Consultant - Threat Management, you will help clients strengthen and modernise their Security Operations, Detection & Response, and Threat Management capabilities across cloud, hybrid, and on-premise environments. Working closely with client security teams, architects, and operational stakeholders, you will design and improve detection strategies, develop high-quality detection content, enhance SIEM/SOAR capabilities, and drive measurable security outcomes through threat-informed defence.

Key responsibilities include:

• Designing, implementing, and improving SIEM and security monitoring capabilities.
• Developing and tuning detection content, analytics rules, and correlation logic.
• Conducting threat hunting exercises aligned to MITRE ATT&CK and client threat profiles.
• Supporting incident response, investigation, and post-incident improvement activities.
• Delivering SOC maturity assessments, capability reviews, and uplift roadmaps.
• Integrating and optimising telemetry across cloud, identity, endpoint, network, and application environments.
• Designing and improving SOAR playbooks and automated response workflows.
• Advising clients on detection engineering standards, operational processes, and security monitoring strategy.
• Producing high-quality technical documentation, runbooks, operating procedures, and client deliverables.
• Leading workshops and presenting findings to both technical and non-technical stakeholders.

Required technical and professional expertise:

• Demonstrable experience within Threat Management, Detection Engineering, Security Operations, Incident Response, or Threat Hunting environments.
• Hands-on experience with one or more major SIEM platforms such as Microsoft Sentinel, Splunk, QRadar, Elastic, Chronicle, LogRhythm.
• Experience developing detection logic, analytics rules, use cases, and threat hunting content.
• Strong understanding of MITRE ATT&CK and threat-informed defence principles.
• Experience supporting or leading incident investigation and response activities.
• Knowledge of cloud security monitoring across Azure, AWS, or GCP environments.
• Experience working with EDR/XDR technologies and associated telemetry.
• Proficiency in KQL, SPL, Python, PowerShell, or equivalent security-focused query/scripting languages.
• Ability to communicate effectively with both technical and business stakeholders.
• Experience operating within regulated environments such as public sector, financial services, healthcare, telecommunications, or critical national infrastructure.

This role is subject to pre-employment screening in line with the UK Government's Baseline Personnel Security Standard (BPSS). An additional range of Personal Security Controls referred to as National Security Vetting (NVS) may apply, this could include meeting the eligibility requirements for The Security Check (SC) or Developed Vetting (DV).

Preferred technical and professional experience:

• Previous consulting or client-facing delivery experience.
• Experience delivering SOC transformation, SOC uplift, or Security Operations improvement programmes.
• Experience building, tuning, or optimising SOAR capabilities and automated response workflows.
• Experience conducting threat-led assessments, purple team exercises, or threat modelling activities.
• Experience with threat intelligence integration, enrichment pipelines, and intelligence-led detection development.
• Exposure to cloud-native security services such as Microsoft Defender XDR, Microsoft Sentinel, AWS GuardDuty, AWS Security Hub, Google Security Operations.
• Experience designing SIEM onboarding strategies, data normalisation approaches, or detection engineering frameworks.
• Understanding of detection-as-code, CI/CD pipelines, or modern security engineering practices.
• Relevant industry certifications such as SC-200, AZ-500, GCIH, GCIAGCDA, Splunk ES certifications, Microsoft Security certifications.
• Experience leading technical workshops, mentoring junior consultants, or shaping client security roadmaps.

IBM is committed to creating a diverse environment and is proud to be an equal-opportunity employer. All qualified applicants will receive consideration for employment without regard to race, colour, religion, sex, gender, gender identity or expression, sexual orientation, national origin, caste, genetics, pregnancy, disability, neurodivergence, age, veteran status, or other characteristics. IBM is also committed to compliance with all fair employment practices regarding citizenship and immigration status.