Mid-Level Information Security Analyst

About the role

We are looking for a Senior CSIRT Analyst with strong specialization in cloud environment security, acting as a technical reference in incident investigation, log analysis, and continuous evolution of detection and response controls in AWS, Microsoft Azure, Google Cloud Platform (GCP), and Oracle Cloud Infrastructure (OCI) environments.

This professional will be responsible for conducting in-depth security incident analyses, identifying monitoring gaps, developing new detection use cases, supporting secure cloud architectures, and driving the maturity of SOC and Incident Response operations, ensuring greater visibility, investigative capability, and reduction of the attack surface of cloud environments.

Responsibilities

Cloud Incident Response

• Support incident investigations involving AWS, Azure, GCP, and OCI environments.
• Conduct advanced technical analyses to identify root cause, scope, impact, and attack vectors.
• Coordinate containment, eradication, and recovery actions for high-criticality incidents.
• Validate and investigate alerts from SIEM, EDR, CSPM, CNAPP, NDR, and native cloud provider tools.
• Produce technical and executive reports containing analyses, evidence, and mitigation recommendations.

Log Analysis and Correlation

• Perform advanced security log analyses in multi-cloud environments.
• Correlate events from different sources to identify suspicious activities and advanced threats.
• Develop and optimize queries in monitoring and SIEM platforms.
• Ensure the quality and coverage of critical logs required for investigation and detection.

Threat Hunting and Detection Engineering

• Conduct continuous hypothesis-driven Threat Hunting activities.
• Develop new use cases based on the MITRE ATT&CK framework.
• Identify detection gaps and propose improvements to increase visibility and response capabilities.
• Validate monitoring coverage through controlled simulations and Purple Team exercises.

Evolving Cloud Security Maturity

• Act as a technical reference for evolving cloud environment security.
• Evaluate native controls and third-party solutions for protecting workloads, containers, identities, and data.
• Propose improvements to SOC processes, playbooks, monitoring, and automations.
• Support Cloud Security Posture Management (CSPM), CNAPP, Zero Trust, and identity protection initiatives.
• Participate in defining security standards for new cloud services and architectures.

Automation and Continuous Improvement

• Develop automations for enrichment, investigation, and incident response.
• Support the evolution of response playbooks using SOAR platforms.
• Promote initiatives to reduce mean time to detect (MTTD) and mean time to respond (MTTR).
• Perform continuous benchmarking of cloud security controls and capabilities.

Required Technical Knowledge

Cloud Security

Proven experience in at least two of the following platforms:

• Amazon Web Services (AWS)
• Microsoft Azure
• Google Cloud Platform (GCP)
• Oracle Cloud Infrastructure (OCI)

Advanced knowledge in:

• IAM and privileged access management
• Container and Kubernetes security
• Workload security
• Cloud network security
• Secrets and cryptographic key management
• Cloud environment hardening
• CloudTrail, Azure Monitor, Defender for Cloud, GCP Audit Logs, OCI Logging, and related services
• Protection of Kubernetes/EKS/AKS/GKE/OKE environments.

Investigation and Response

• Solid experience in CSIRT, SOC N3, or DFIR.
• Complex incident investigation.
• Basic forensic analysis on endpoints and workloads.
• Analysis of IOCs, TTPs, and adversary behavior.
• MITRE ATT&CK framework.
• NIST 800-61 and ISO 27035.

Monitoring and Detection

Experience with:

• Monitoring use cases
• Detection engineering
• Event correlation
• Threat Hunting

Education

• Bachelor's degree in Information Technology, Information Security, Computer Science, Computer Engineering, or related fields.

Nice to Have

• Experience in financial institutions or highly regulated environments.
• Experience with multi-cloud architectures.
• Experience in Purple Team programs.
• Experience in Cloud Security Assessment and Cloud Threat Hunting.
• Knowledge of CNAPP, CSPM, CWPP, and DSPM.
• Experience with DevSecOps and secure CI/CD pipelines.

Work model and location

This is a hybrid role, with on-site activities in São Paulo, combining office days and remote work days.