Security Consultant - GRC

Overview

A career in IBM Consulting is built on long-term client relationships and close collaboration worldwide. You’ll work with leading companies across industries, helping them shape their hybrid cloud and AI journeys. With support from our strategic partners, robust IBM technology, and Red Hat, you’ll have the tools to drive meaningful change and accelerate client impact. At IBM Consulting, curiosity fuels success. You’ll be encouraged to challenge the norm, explore new ideas, and create innovative solutions that deliver real results. Our culture of growth and empathy focuses on your long-term career development while valuing your unique skills and experiences.

Your Role And Responsibilities

You will be responsible for the documentation, control testing, and compliance alignment of our security operations. You will work closely with SOC analysts and engineers to translate technical security controls into audit-ready evidence, manage risks identified during investigations, and ensure that incident response procedures are compliant with regulatory mandates.

Key Responsibilities

• Control Monitoring & Testing:
• Assist in the design, implementation, and testing of technical controls within the SOC environment (e.g., alerting rules, access controls, change management).
• Perform periodic assessments of SOC tools and processes to ensure they meet internal policy and regulatory standards.
• Gather and validate evidence for internal and external audits (e.g., RBI, ISO 27001, PCI-DSS) related to security monitoring and incident response.
• Incident Response & Compliance:
• Review incident response documentation (playbooks, reports, post-mortems) to ensure they comply with legal, regulatory, and contractual obligations (e.g., breach notification timelines).
• Track and document how incidents are managed from a compliance perspective, ensuring proper chain of custody and evidence handling.
• Risk Management:
• Collaborate with the SOC to identify and document risks related to security monitoring gaps, threat intelligence, or vulnerability management.
• Assist in the risk assessment process for new security tools or changes to the monitoring infrastructure.
• Track remediation efforts for risks identified during tabletop exercises or real incidents.
• Policy & Procedure Development:
• Maintain and update SOC-related policies and procedures (e.g., Incident Response Plan, SOC Standard Operating Procedures).
• Ensure documentation is kept current with the evolving threat landscape and changes in regulatory requirements.
• Assist in the creation of training materials to socialize compliance requirements with the technical SOC team.
• Metrics & Reporting:
• Develop key risk indicators (KRIs) and key performance indicators (KPIs) for SOC compliance (e.g., time to containment, audit finding closure rates).
• Prepare compliance dashboards and reports for management and the Chief Information Security Officer (CISO).
  
  

Master's Degree

Required Technical And Professional Expertise

Experience: 3 to 5 years of experience in a combination of GRC (Governance, Risk, Compliance) and Security Operations or IT Audit.

• Frameworks Knowledge: Solid understanding of common security frameworks and standards, such as NIST Cybersecurity Framework (CSF) , ISO 27001, SOC 2, or PCI-DSS.
• Incident Response Lifecycle: Familiarity with the phases of incident response (Preparation, Detection, Analysis, Containment, Eradication, Recovery, Post-Incident) and the associated documentation requirements.
• Technical Aptitude: Ability to understand technical security controls (firewalls, EDR, SIEM) well enough to verify their configuration against compliance requirements. You don't need to be an engineer, but you must be able to "speak the language."
• Documentation: Exceptional written communication skills with a knack for creating clear, concise, and audit-ready documentation.
• Analytical Skills: Ability to analyze complex processes and identify gaps in controls or compliance.
  
  

Audit Experience: Experience participating in or leading external audits and regulatory examinations.

• Cloud Security: Understanding of cloud compliance concepts (AWS Config, Azure Policy) and the shared responsibility model.