X-Force Incident Response Deputy APAC Lead

Introduction
A career in IBM Consulting is rooted by long-term relationships and close collaboration with clients across the globe.

You’ll work with visionaries across multiple industries to improve the hybrid cloud and AI journey for the most innovative and valuable companies in the world. Your ability to accelerate impact and make meaningful change for your clients is enabled by our strategic partner ecosystem and our robust technology platforms across the IBM portfolio; including Software and Red Hat.

Curiosity and a constant quest for knowledge serve as the foundation to success in IBM Consulting. In your role, you’ll be encouraged to challenge the norm, investigate ideas outside of your role, and come up with creative solutions resulting in ground breaking impact for a wide network of clients. Our culture of evolution and empathy centers on long-term career growth and development opportunities in an environment that embraces your unique skills and experience.

Your Role and Responsibilities
The X-Force Incident Response team (XFIR) helps IBM customers globally with their Digital Forensics and Incident Response needs, whether that’s before, during, or after an incident. Proactive projects include running tabletop exercises or helping to improve IR documentation, whereas reactive engagements might involve expert level forensic analysis to quantify Intellectual Property theft, or leading IR activities on one of the biggest data breaches in the world.

Many of the existing members of the team are DFIR all-rounders that are as comfortable chewing through log files at the command line during threat hunting as presenting an executive summary of an incident to board members. Cases will include everything from false alarms to nation state attacks against critical infrastructure. Efficient and methodical collaboration is key in projects of this scale, as is excellent written and spoken English.

You will also have demonstrated skills in various elements of Incident Response, conducting computer intrusion investigations, and have a strong foundation in cyber security policy, operations and best practices. This might include proficiency with leading EDR tools, familiarity with forensic analysis tools such as X-Ways or EnCase, or forensic triage expertise using Velociraptor or UAC. Furthermore, familiarity with Windows and Linux operating systems and enterprise technology such as Active Directory / LDAP / Entra ID, on-premises and cloud-based email, and network devices such as firewalls, proxies, IPS/IDS, SIEMs, etc. is preferred.

As an experienced consultant, you’ll understand that the nature of the work sometimes involves late nights, early starts, weekends, or travel at short notice. In return, XFIR provides time off in lieu, weekend on-call allowance and the ability to manage your own time wherever possible. We don’t offer opaque bonus schemes but can offer a base salary designed attract the best people for the job.

The selected candidate will be assigned as the X-Force Incident Response Deputy Lead for the APAC region. The position can be Bangkok/Philippines.

In this role you must have at least 5 years of technical and professional experience in the following:

• Experience and subject matter expertise in one or more of the following specialties: incident response, systems administration, disaster recovery, business continuity, computer forensics and/or network security.
• Experience managing technical security projects either as a consultant or internal security practitioner.
• A thorough understanding of network protocols, network devices, computer security devices, secure architecture & system administration in support of computer forensics & network security operations.
• Significant hands-on experience with hardware/software tools used in incident response, computer forensics, network security assessments, and/or application security.
• Experience with assessing and developing enterprise-wide policies and procedures for IT risk mitigation and incident response.
• Experience in Windows, Mac, and Unix operating systems.

Required Technical and Professional Expertise
Concepts and Communication

• Demonstrated ability to work with and advise senior and executive level clients regarding strategic and tactical processes of Incident Response, staying professional and communicating clearly under pressure.
• Advanced understanding of information security governance concepts, including ability to gauge maturity level of an organisation’s incident response program by against best practices as well as by applying practical knowledge