Security Delivery Consultant

About the Role

Accenture Middle East is seeking a Security Delivery Consultant to join their team in Riyadh, Riyadh. This full-time role requires 5-10 years of experience and involves acting as a subject-matter expert across Security Operations, Incident Response, SIEM, Endpoint Detection and Response (EDR), and Network Detection and Response (NDR). The consultant will lead complex security investigations, enhance detection capabilities, administer critical security platforms, and guide team members in delivering effective cybersecurity operations.

Key Responsibilities

• Develop, maintain, and improve Incident Response plans, SOC policies, processes, procedures, and operational playbooks.
• Lead the detection, triage, investigation, containment, and response to complex cybersecurity events and incidents.
• Analyze security events and telemetry to determine their nature, scope, severity, and potential business impact.
• Provide technical direction and guidance to team members during investigations and response activities.
• Coordinate escalations and ensure incidents are handled according to established procedures.
• Participate in on-call and after-hours security support when required.
• Work with SIEM engineers to develop, refine, and optimize security-monitoring use cases.
• Create and tune correlation and detection rules using telemetry from SIEM, EDR, NDR, and other security technologies.
• Administer and optimize enterprise Endpoint Detection and Response and Network Detection and Response technologies.
• Deploy, upgrade, and maintain EDR agents across Windows, macOS, and Linux environments.
• Develop, implement, and maintain EDR and NDR policies, configurations, and monitoring rules.
• Integrate EDR and NDR platforms with SIEM and other cybersecurity technologies.
• Produce clear, actionable cyber intelligence, incident, and operational reports.
• Communicate technical findings, security risks, business impact, and recommended actions to various audiences.
• Provide technical leadership, coaching, and knowledge-sharing to cybersecurity team members.
• Collaborate across SOC, security engineering, infrastructure, network, application, and business teams.

Qualifications and Experience

• Strong experience in Security Operations and Incident Response.
• Demonstrated experience developing or maintaining Incident Response plans, SOC policies, processes, procedures, and playbooks.
• Hands-on experience using security tools and technologies for detection, investigation, and response.
• Strong knowledge of Security Information and Event Management (SIEM) technologies.
• Experience developing, refining, and tuning SIEM correlation or detection rules.
• Hands-on experience administering enterprise EDR and NDR platforms.
• Experience deploying and maintaining EDR agents across Windows, macOS, and Linux.
• Experience integrating EDR and NDR platforms with SIEM and other security technologies.
• Strong understanding of security-event analysis, alert triage, incident investigation, and response.
• Ability to lead technical investigations and provide clear guidance to team members.
• Ability to participate in on-call or after-hours support when required.

Required Skills

• Strong analytical, troubleshooting, and organizational capabilities.
• Excellent verbal and written communication skills.
• Ability to communicate both technical and strategic cybersecurity matters to diverse audiences.
• Strong documentation, cyber intelligence reporting, and stakeholder-management capabilities.

Preferred Qualifications

• GIAC Certified Incident Handler (GCIH).
• GIAC Continuous Monitoring Certification (GMON).
• GIAC Certified Forensic Analyst (GCFA).
• Equivalent certifications in Incident Response, SOC operations, digital forensics, or security monitoring.
• Experience supporting a large-scale enterprise or Managed Security Services environment.
• Exposure to threat hunting, cyber threat intelligence, or digital forensics.
• Familiarity with MITRE ATT&CK and detection-engineering methodologies.
• Experience with platforms such as Splunk, Microsoft Sentinel, IBM QRadar, Microsoft Defender, or CrowdStrike.

Work Environment

This is a full-time position based in Riyadh, Riyadh. The role involves working with security engineering, infrastructure, network, and business stakeholders to continuously improve cyber defense processes, technologies, and reporting.