Overview

As a Manager in EY s Cybersecurity practice, you will play a pivotal role in delivering advanced Security Operations, Incident Response, Security Orchestration, and Threat Intelligence services across diverse client environments.

Responsibilities

• Deploy, configure, and administer IBM QRadar, Splunk, and ELK Stack SIEM platforms across multiple client environments.
• Design and implement SIEM use cases, correlation rules, dashboards, and reporting mechanisms.
• Integrate log sources from network, endpoint, cloud, application, and OT environments.
• Monitor and optimize SIEM performance, health, and event processing capabilities.
• Perform tuning of offense rules to minimize false positives and improve detection efficiency.
• Support onboarding of new customers, assets, and log sources into the managed SOC environment.
• Lead investigations of security alerts, incidents, and suspicious activities identified through IBM QRadar, Splunk, and ELK Stack.
• Develop and maintain detection content aligned to evolving threat landscapes and industry best practices.
• Support incident response activities, forensic investigations, and root cause analysis.
• Collaborate with stakeholders to improve security visibility across IT and OT environments.
• Communicate complex technical concepts to senior stakeholders and business leaders.
• Mentor junior consultants and SOC analysts, fostering a culture of continuous learning and operational excellence.
• Deploy and configure SOAR platforms such as Phantom, XSOAR, Resilient supporting multi-tenant MSSP operations.
• Design and implement automated incident response workflows and response playbooks.
• Develop integrations between SOAR, SIEM, endpoint security, ticketing systems, and threat intelligence platforms.
• Configure incident types, workflows, tasks, and escalation processes for client environments.
• Maintain and enhance security orchestration workflows to improve SOC efficiency and response times.
• Troubleshoot integration, automation, and workflow performance issues.
• Collaborate with SOC teams to identify automation opportunities across incident handling processes.
• Lead customer onboarding, migration, and expansion activities within SOAR platforms.
• Develop custom scripts and automation use cases using supported APIs and integration frameworks.
• Ensure governance, auditability, and operational effectiveness of automated response actions.
• Support SOC analysts during complex incident investigations and escalations.
• Mentor junior consultants and engineers in automation best practices.
• Deploy, configure, and manage Threat Management Platform such as CTM360, CyberArk, BitSight, RecordedFuture capabilities across client environments.
• Monitor external threat exposure and digital attack surfaces for multiple clients.
• Perform threat intelligence analysis to identify emerging threats, adversary activities, and indicators of compromise (IOCs).
• Correlate threat intelligence findings with SIEM and SOAR platforms to enhance detection capabilities.
• Develop threat intelligence reports, executive briefings, and strategic risk assessments.
• Monitor brand exposure, domain threats, credential leaks, phishing campaigns, and digital risks.