Cybersecurity Remediation Engineer

About the role

The CISO Remediation Team at IBM Infrastructure & Technology is looking for a Cybersecurity Remediation Engineer to join its Cyber Defense organization. The role contributes to and, over time, drives the technical resolution of security risk across the IBM enterprise, at the intersection of security operations, engineering and architecture. It helps teams recover from incidents, remediate vulnerabilities and implement durable, scalable security improvements. Depending on engagement and experience, you may fix issues directly, partner with engineering teams to drive fixes, or design repeatable remediation patterns.

Key responsibilities

• Support containment, recovery and post-incident remediation by identifying root causes and implementing technical fixes that reduce recurrence.
• Partner with product, engineering and infrastructure teams to embed security within existing practices.
• Conduct security and risk assessments of applications, platforms and infrastructure, including threat modeling and targeted technical review.
• Apply security principles to protect systems and data, covering availability, authentication, authorization, confidentiality and integrity.
• Create technical documentation outlining remediation guidance and security best practices.
• Develop or implement tools to support detection, prevention and analysis of security threats.

Required profile

• Bachelor's degree.
• Thrives in high-pressure environments, thinking like both attacker and defender, and communicates clearly with technical and non-technical stakeholders.
• Deep expertise in one or two technical domains and working knowledge of adjacent areas.
• Experience conducting security reviews and translating findings into actionable engineering guidance.
• Experience applying and maintaining secure configurations across systems, networks or applications.
• Ability to use AI tools to speed up triage, remediation recommendations and incident response, with human review and judgement.
• Knowledge of vulnerability management, common attack patterns and mitigation techniques (e.g. OWASP Top 10, MITRE ATT&CK).

Required skills

• Scripting, automation and infrastructure as code: Python, Ansible, Terraform or similar.
• Cloud and virtualized environments: IBM Cloud, AWS, Azure, GCP, virtualization and containers.
• Operating systems and networking: Windows or Linux, network segmentation, SDN and isolation.
• Security technologies: EDR, NGFW, IDS, SIEM, SOAR and related platforms.
• Preferred: incident response or post-incident remediation experience, cloud platforms, CI/CD pipelines, Kubernetes, Agile, and familiarity with NIST CSF, NIST 800-series, ISO 27001 and PCI.