Cybersecurity Remediation Engineer

The CISO Remediation Team is looking to add a cybersecurity Remediation Engineer as part of the overall Cyber Defense organization. In this role, you will contribute to and, over time, drive the technical resolution of security risk across the IBM enterprise, operating at the intersection of security operations, engineering, and architecture. You will help teams recover from incidents, remediate vulnerabilities, and implement durable, scalable security improvements.

While this role spans multiple remediation domains, we are particularly interested in candidates with deep expertise in Microsoft Active Directory, including hands-on experience designing, deploying, securing, hardening, troubleshooting, and recovering Active Directory environments. Experience leading or supporting recovery of Active Directory following ransomware incidents, cyberattacks, operational failures, or large-scale outages is highly valued.

Depending on the engagement and experience level, you may remediate issues directly, partner with engineering teams to drive fixes, or design repeatable remediation patterns. This role is not a primary SOC, detection, or application security pipeline ownership role, but partners closely with those teams to drive remediation outcomes.

The ideal candidate thrives in high‑pressure environments, thinks like both an attacker and defender, and communicates clearly with technical and non‑technical stakeholders.

While this role includes a focus on Active Directory and identity security, the successful candidate will participate in the full spectrum of remediation activities across infrastructure, cloud, network, application, and security domains, contributing to the team's broader mission of reducing enterprise security risk.

Areas of specialization may include

• Identity & Active Directory Security: Active Directory architecture, deployment, domain services, Group Policy, Entra ID/Azure AD integration, tiered administration, privileged access management, LAPS, authentication protocols (Kerberos, NTLM), Active Directory hardening, forest/domain recovery, and ransomware recovery operations.
• Scripting, Automation & Infrastructure as Code: Python, Ansible, Terraform, or similar tooling
• Cloud & Virtualized Environments: IBM Cloud, AWS, Azure, GCP; virtualization and container platforms
• Operating Systems & Networking: Windows or Linux; network segmentation, SDN, and isolation techniques
• Security Technologies: EDR, NGFW, IDS, SIEM, SOAR, and related platforms

Key Duties

• Lead technical remediation efforts, with particular focus on identity infrastructure, Active Directory, and privileged access systems when required.
• Assess Active Directory environments for security weaknesses and guide hardening efforts aligned with industry best practices.
• Support containment, recovery, vulnerability remediation, and post-incident corrective actions by identifying root causes, implementing technical fixes, hardening configurations, deploying security controls, and validating risk reduction outcomes.
• Partner with product, engineering, and infrastructure teams to implement remediation plans and improve the security posture of their environments.
• Drive the implementation of secure configurations across infrastructure, operating systems, cloud platforms, identity systems, and applications.
• Create technical documentation outlining remediation guidance and security best practices.
• Develop or implement automation and tooling to accelerate remediation, configuration management, vulnerability reduction, and security operations at scale.