Business Process Consultant

About the Role

Deloitte's Cyber team delivers powerful solutions to help clients navigate the evolving threat landscape. This role focuses on delivering solutions and managed services that simplify complexity, enabling clients to operate with resilience, grow with confidence, and manage proactively to secure success.

Key Responsibilities

• Facilitate workshops, stakeholder interviews, and requirements gathering with Security Operations Center (SOC), Incident Response, and Threat Intelligence teams to document current-state and future-state processes based on ServiceNow out-of-the-box principles.
• Map incident lifecycles, supporting tools, and data to ServiceNow Security Incident Response (SIR) capabilities and data models; identify gaps and migration considerations.
• Develop epics, user stories, requirements, Responsible, Accountable, Consulted, and Informed (RACI) matrices, data flows, and integration needs for SIEM, EDR, Threat Intelligence Security Center (TISC), and CMDB platforms.
• Support functional design and configuration of the SIR workspace, incident forms and states, assignment and escalation rules, response tasks, playbooks, flows, notifications, SLAs, dashboards, roles, and access controls.
• Produce test scenarios, training materials, and release notes; manage user story assignment, backlog grooming, sprint preparation, story refinement, demonstrations, user acceptance testing, defect triage, cutover, and risk tracking with engagement managers.

Requirements & Tech Stack

• ServiceNow
• Security Operations (SecOps)
• Security Incident Response (SIR)
• Security Information and Event Management (SIEM)
• Endpoint Detection and Response (EDR)
• Threat Intelligence Security Center (TISC)
• Configuration Management Database (CMDB)
• ServiceNow Certified System Administrator (CSA)
• Now Assist for Security Operations (Preferred)
• Splunk (Preferred for SIEM integration)
• Microsoft Sentinel (Preferred for SIEM integration)
• CrowdStrike (Preferred for EDR integration)
• Microsoft Defender (Preferred for EDR integration)
• National Institute of Standards and Technology (NIST) Special Publication 800-61 (Preferred)
• NIST Cybersecurity Framework (CSF) (Preferred)
• MITRE ATT&CK (Preferred)

Qualifications

• Bachelor's degree in Computer Science, Information Systems, Cybersecurity, Engineering, Information Technology, or Business Administration.
• ServiceNow Certified System Administrator (CSA).
• 2+ years supporting ServiceNow implementation projects in a client-facing consulting role.
• 2+ years gathering business requirements, facilitating workshops, and documenting process flows or user stories.
• 2+ years designing, configuring, or implementing ServiceNow Security Incident Response (SIR).
• Experience supporting Security Operations Center (SOC) and incident response processes.
• Ability to travel 50%, on average.
• Limited immigration sponsorship may be available.

Preferred Qualifications

• One or more of the following credentials: ServiceNow Certified Application Developer (CAD), ServiceNow Certified Implementation Specialist - Security Incident Response (CIS-SIR), or Architecture Excellence (ArchX).
• Experience with ServiceNow Major Security Incident Management, Data Loss Prevention, or Threat Intelligence Security Center (TISC) applications.
• Experience integrating ServiceNow with SIEM or EDR tools.
• Experience as a SOC analyst or incident responder.

Skills

• Ability to work independently and collaborate as part of a team.
• Effective written and verbal communication skills.
• Meticulous attention to detail and quality of work product.
• Ability to build and sustain professional relationships.
• Ability to lead projects or workstreams.
• Ability to manage and prioritize multiple tasks in a fast-paced and dynamic environment.
• Strong interpersonal skills and professional demeanor.
• Ability to meet deadlines.
• Ability to provide clear guidance to others.

Compensation

• Wage range: $82,600 to $162,800.
• May be eligible for a discretionary annual incentive program.