**Introduction** The CISO Cybersecurity Operations Platform (CSOP) team is looking to add an engineer to the Analytics and Data Exploitation team. The Platform provides the technology, services and expertise required by IBM’s Cyber Threat Detection and Response teams. We support the Advanced Threat Detection (threat hunting, intelligence, incident response), Vulnerability Detection and Response, Innovation and Remediation, Security Operations Centers and Command Centers teams to deliver enterprise-wide security to one of the world’s most established technology companies. We process tens of billions of events per day, meaning effective analysis and data exploitation practices are critical to our success. This is a technical position within the Analytics and Data Exploitation team who employ commercial, open source and in-house developed tools to deliver critical cybersecurity services such as event processing, automation, complex analytics and support to digital investigations. This role operates across our development, test, pre-production and production networks to create, maintain and improve our services -an important component of which is fault-finding and the ability to work within complex, dynamic environments. The right candidate thrives in high-pressure situations and has practical experience working with Big Data technologies -such as Spark, Hadoop and Elasticsearch. The role requires a proven, practical knowledge of container orchestration technologies -specifically Kubernetes and RedHat OpenShift. The work will include the design and optimization of container-deployed systems, as well as the day-to-day engineering and administration of the orchestration environment. This includes cluster management, Pod assignment / configuration, application virtual routing, security, container image registry management and optimization of the runtime engines. Wider knowledge of data ingestion, extraction, transformation and loading technologies is important - including Streamsets and Flink. The role is rounded-out by some software development tasks - all related to cyber security. These will involve Java, SQL, Python and automation scripting so experience with DevSecOps methods is highly advantageous. The Platform team employs hybrid cloud hosting and this includes provisioning, administration and management of services within environments spanning IBM Cloud, Amazon Web Services and Microsoft Azure. About the Team The CISO Cybersecurity Operations Platform (CSOP) team is looking to add an Email Security Engineer to the team. The CSOP provides the technology, services and expertise required by IBM’s Cyber Threat Detection and Response teams. We support the Advanced Threat Detection (threat hunting, intelligence, incident response), Vulnerability Detection and Response, Remediation, Security Operations Center and Command Center teams to deliver enterprise-wide security to one of the world’s most established technology companies. **Your role and responsibilities** Job Duties: · Contribute to the day-to-day work that supports our critical cybersecurity analysis and data processing workflows · Protect organization against phishing, spoofing, malware, and advanced threats while maintaining user experience and compliance · Familiarity with Exchange, ProofPoint Email Solutions, Powershell, Azure, and M365 suite · Design, implement and maintain secure email solutions within the Microsoft 365 tenant and related servces · Moniotr and respond to email-related security incidents, phishing attempts, and compromise events · Support the team leadership to improve overall exploitation of technologies that best serve our requirements · Partner with CIO and CISO teams to develop email security policies, rules, and playbooks - Work as part of a deeply technical, passionate team of engineers to tackle significant IT challenges **Required technical and professional expertise** · 3 or more years’ experience in an email security engineer or similar role · Experience with Microsoft 365 Exchange or Proofpoint email solutions · Hands on experience with SPF, DKIM, and DMARC configuration and rollout at an enterprise level · Experience with (or a proven aptitude for) working within a fast-paced environment where the success criteria are defined by external factors. This includes having to change course quickly, based on the evolving needs of a complex and dynamic environment · Strong experience with incident response processes for phishing and email-based threats · Experience with IBM Cloud, AWS, Azure or similar cloud environments · Strong understanding of email protocols ISMPT, IMAP, POP3) and security controls · Familiarity with SIEM tools for monitoring and automation on email threats · Excellent problem-solving, communication, and documentation skills **Preferred technical and professional experience** · Experience with secure email gateways (Proofpoint, M365, etc) · Microsoft certification · Knowledge of zero trust frameworks and modern authentication methods (MFA, conditional access) · Familiarity with cloud-native security tools (Sentinel, Defender, XDR) · Understanding of email encryption solutions (TLS, S/MIME, PGP) · Experience in large enterprise environments with hybrid Microsoft Exchange deployments · Ansible experience is a strong advantage IBM is committed to creating a diverse environment and is proud to be an equal-opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, gender, gender identity or expression, sexual orientation, national origin, caste, genetics, pregnancy, disability, neurodivergence, age, veteran status, or other characteristics. IBM is also committed to compliance with all fair employment practices regarding citizenship and immigration status.