Your role and responsibilities
The CISO Remediation Team is looking to add a cybersecurity Remediation Engineer as part of the overall Cyber Defense organization. In this role, you will contribute to and, over time, drive the technical resolution of security risk across the IBM enterprise, operating at the intersection of security operations, engineering, and architecture. You will help teams recover from incidents, remediate vulnerabilities, and implement durable, scalable security improvements.
While this role spans multiple remediation domains, we are particularly interested in candidates with deep expertise in Microsoft Active Directory, including hands-on experience designing, deploying, securing, hardening, troubleshooting, and recovering Active Directory environments. Experience leading or supporting recovery of Active Directory following ransomware incidents, cyberattacks, operational failures, or large-scale outages is highly valued.
Depending on the engagement and experience level, you may remediate issues directly, partner with engineering teams to drive fixes, or design repeatable remediation patterns. This role is not a primary SOC, detection, or application security pipeline ownership role, but partners closely with those teams to drive remediation outcomes.
The ideal candidate thrives in high-pressure environments, thinks like both an attacker and defender, and communicates clearly with technical and non-technical stakeholders.
While this role includes a focus on Active Directory and identity security, the successful candidate will participate in the full spectrum of remediation activities across infrastructure, cloud, network, application, and security domains, contributing to the team's broader mission of reducing enterprise security risk.
Areas of specialization may include:
- Identity & Active Directory Security: Active Directory architecture, deployment, domain services, Group Policy, Entra ID/Azure AD integration, tiered administration, privileged access management, LAPS, authentication protocols (Kerberos, NTLM), Active Directory hardening, forest/domain recovery, and ransomware recovery operations.
- Scripting, Automation & Infrastructure as Code: Python, Ansible, Terraform, or similar tooling
- Cloud & Virtualized Environments: IBM Cloud, AWS, Azure, GCP; virtualization and container platforms
- Operating Systems & Networking: Windows or Linux; network segmentation, SDN, and isolation techniques
- Security Technologies: EDR, NGFW, IDS, SIEM, SOAR, and related platforms
Key Duties:- Lead technical remediation efforts, with particular focus on identity infrastructure, Active Directory, and privileged access systems when required.
- Assess Active Directory environments for security weaknesses and guide hardening efforts aligned with industry best practices.
- Support containment, recovery, vulnerability remediation, and post-incident corrective actions by identifying root causes, implementing technical fixes, hardening configurations, deploying security controls, and validating risk reduction outcomes.
- Partner with product, engineering, and infrastructure teams to implement remediation plans and improve the security posture of their environments.
- Drive the implementation of secure configurations across infrastructure, operating systems, cloud platforms, identity systems, and applications.
- Create technical documentation outlining remediation guidance and security best practices.
- Develop or implement automation and tooling to accelerate remediation, configuration management, vulnerability reduction, and security operations at scale.
Required education
Bachelor's Degree
Required technical and professional expertise
- 8+ years of experience in Active Directory, identity engineering, infrastructure security, or related enterprise engineering disciplines.
- Demonstrated experience deploying, configuring, administering, and securing Microsoft Active Directory in enterprise environments.
- Strong understanding of Active Directory architecture including forests, domains, trusts, replication, DNS integration, and identity lifecycle management.
- Experience developing, testing, and executing Active Directory recovery plans, including forest and domain recovery following operational failures, security incidents, or ransomware events.
- Strong understanding of identity-based attack techniques including Kerberoasting, Pass-the-Hash, Golden Ticket, Silver Ticket, DCSync, and credential theft attacks.
- Ability to work independently or as part of a team while operating effectively in ambiguous, fast-moving environments.
- Strong problem-solving skills with attention to detail and a proactive mindset.
- Strong interpersonal and communication skills with the ability to work effectively across engineering, security, and business teams; and explain technical remediation steps to non-technical stakeholders.
- Ability to collaborate effectively and, with experience, influence remediation outcomes across federated teams.
- Ability to leverage automation and AI-assisted tooling to improve remediation effectiveness and operational efficiency.
- Knowledge of vulnerability management and remediation techniques across infrastructure, cloud, identity and/or application environments.
Preferred technical and professional experience
- Experience leading or participating in Active Directory forest recovery, domain recovery, identity compromise, ransomware recovery, or enterprise disaster recovery exercises.
- Experience securing hybrid identity environments integrating Microsoft Active Directory and Microsoft Entra ID.
- Prior experience as a systems administrator, network engineer, cloud engineer, platform engineer, site reliability engineer (SRE), infrastructure engineer, or similar hands-on operational role; experience supporting incident recovery or post-incident remediation is highly desirable.
- Experience with cloud platforms, CI/CD pipelines, containerization, and Kubernetes.
- Experience using automation and AI to reduce mean time to remediation (MTTR).
- Familiarity with Agile development environments.
- Foundational understanding of cybersecurity frameworks and regulations and how they inform risk-based remediation decisions. (e.g., NIST CSF, NIST 800-series, ISO 27001, PCI.)
OTHER RELEVANT JOB DETAILSIBM offers a competitive and comprehensive benefits program. Eligible employees may have access to:
- Healthcare benefits including medical & prescription drug coverage, dental, vision, and mental health & well being
- Financial programs such as 401(k), cash balance pension plan, the IBM Employee Stock Purchase Plan, financial counseling, life insurance, short & long- term disability coverage, and opportunities for performance based salary incentive programs
- Generous paid time off including 12 holidays, minimum 56 hours sick time, 120 hours vacation, 12 weeks parental bonding leave in accordance with IBM Policy, and other Paid Care Leave programs. IBM also offers paid family leave benefits to eligible employees where required by applicable law
- Training and educational resources on our personalized, AI-driven learning platform where IBMers can grow skills and obtain industry-recognized certifications to achieve their career goals
- Diverse and inclusive employee resource groups, giving & volunteer opportunities, and discounts on retail products, services & experiences
We consider qualified applicants with criminal histories, consistent with applicable law.
This position was posted on the date cited in the key job details section and is anticipated to remain posted for 21 days from this date or less if not needed to fill the role.
IBM will not be providing visa sponsorship for this position now or in the future. Therefore, in order to be considered for this position, you must have the ability to work without a need for current or future visa sponsorship.
The compensation range and benefits for this position are based on a full-time schedule for a full calendar year. The salary will vary depending on your job-related skills, experience and location. Pay increment and frequency of pay will be in accordance with employment classification and applicable laws. For part time roles, your compensation and benefits will be adjusted to reflect your hours. Benefits may be pro-rated for those who start working during the calendar year.
