Security Delivery Consultant

About the Role

Accenture Saudi Arabia is seeking a Security Delivery Consultant for a full-time position in Riyadh. This role involves acting as a subject-matter expert across Security Operations, Incident Response, SIEM, Endpoint Detection and Response (EDR), and Network Detection and Response (NDR). The consultant will lead complex security investigations, enhance detection capabilities, administer critical security platforms, and guide team members in delivering effective cybersecurity operations. Collaboration with security engineering, infrastructure, network, and business stakeholders will be essential for continuous improvement of cyber defense processes, technologies, and reporting.

Key Responsibilities

• Develop, maintain, and improve Incident Response plans, SOC policies, processes, procedures, and operational playbooks.
• Lead the detection, triage, investigation, containment, and response to complex cybersecurity events and incidents.
• Analyze security events and telemetry to determine their nature, scope, severity, and potential business impact.
• Provide technical direction and guidance to team members during investigations and response activities.
• Coordinate escalations and ensure incidents are handled according to established procedures and service requirements.
• Participate in on-call and after-hours security support when required.
• Identify lessons learned from security incidents and translate them into improvements across people, process, and technology.
• Work with SIEM engineers and other cybersecurity teams to develop, refine, and optimize security-monitoring use cases.
• Create and tune correlation and detection rules using telemetry from SIEM, EDR, NDR, and other security technologies.
• Administer and optimize enterprise EDR and NDR technologies, including deployment, upgrades, maintenance, and policy configuration.
• Monitor agent health, coverage, and connectivity for EDR, and troubleshoot reporting issues.
• Integrate EDR and NDR platforms with SIEM and the broader security technology ecosystem.
• Produce clear, actionable cyber intelligence, incident, and operational reports.
• Communicate technical findings, security risks, business impact, and recommended actions to diverse audiences, including senior management.
• Provide technical leadership, coaching, and knowledge-sharing to cybersecurity team members.
• Collaborate across SOC, security engineering, infrastructure, network, application, and business teams.
• Support continuous improvement initiatives that strengthen the overall maturity and effectiveness of security operations.

Qualifications and Experience

• Strong experience in Security Operations and Incident Response.
• Demonstrated experience developing or maintaining Incident Response plans, SOC policies, processes, procedures, and playbooks.
• Hands-on experience using security tools and technologies for detection, investigation, and response.
• Strong knowledge of Security Information and Event Management (SIEM) technologies.
• Experience developing, refining, and tuning SIEM correlation or detection rules.
• Hands-on experience administering enterprise EDR and NDR platforms.
• Experience deploying and maintaining EDR agents across Windows, macOS, and Linux environments.
• Experience integrating EDR and NDR platforms with SIEM and other security technologies.
• Strong understanding of security-event analysis, alert triage, incident investigation, and response.
• Ability to lead technical investigations and provide clear guidance to team members.
• Ability to participate in on-call or after-hours support when required.

Required Skills

• Strong analytical, troubleshooting, and organizational capabilities.
• Excellent verbal and written communication skills.
• Ability to communicate both technical and strategic cybersecurity matters to diverse audiences.
• Strong documentation, cyber intelligence reporting, and stakeholder-management capabilities.

Preferred Certifications and Experience

• GIAC Certified Incident Handler (GCIH)
• GIAC Continuous Monitoring Certification (GMON)
• GIAC Certified Forensic Analyst (GCFA)
• Equivalent certifications in Incident Response, SOC operations, digital forensics, or security monitoring.
• Experience supporting a large-scale enterprise or Managed Security Services environment.
• Exposure to threat hunting, cyber threat intelligence, or digital forensics.
• Familiarity with MITRE ATT&CK and detection-engineering methodologies.
• Experience with platforms such as Splunk, Microsoft Sentinel, IBM QRadar, Microsoft Defender, or CrowdStrike.