Senior Information Security Analyst, Cloud Security

Jobtailor; São Paulo; Presencial; BRL 280 000 - 420 000; Tempo integral

Resumo da oferta

Jobtailor in São Paulo seeks an experienced Cloud Incident Detection and Response lead to own security across AWS and Azure environments. You will define baselines, implement controls, and mentor teams to strengthen cloud security posture.

You will develop detection cases, automate security workflows in IaC, and ensure visibility by integrating cloud logs into Splunk. Advanced English and multi-cloud experience are required.

Qualificações

• Bachelor's degree in Information Security, Computer Science, Engineering, Information Systems or related fields.
• 5–7 years of information security experience with at least 3 years in cloud security, detection or incident response.
• Experience in complex, regulated and multi-cloud environments; retail is a plus.
• Advanced English for technical reading and collaboration with international teams.
• Cloud incident detection and response across AWS and/or Azure.
• Baseline and security control definition for cloud services (compute, storage, networking, containers).
• Security of AWS data and infrastructure services (S3, Redshift, Glue, Lambda, VPC, CloudWatch).
• IAM, CSPM/CWPP: misconfigurations and continuous hardening.

Responsabilidades

• Lead the Cloud Incident Detection and Response practice for incident visibility and response.
• Develop and maintain security controls for AWS and Azure environments.
• Monitor and improve security posture of cloud data and infrastructure services.
• Protect cloud workloads including containers, VPCs, and network segmentation.
• Collaborate with Architecture and Engineering to influence secure designs.
• Develop IaC security practices with Terraform or CloudFormation and template scanning.
• Perform hardening, vulnerability management, and reviews of cloud environments.
• Develop and operate cloud-specific detection cases and detections.
• Integrate cloud logs into Splunk for end-to-end detection coverage.
• Participate in risk analyses, troubleshooting and incident response with CSIRT/SOC.
• Translate findings into business risk and remediation prioritization.
• Produce technical and executive reports on security posture and gaps.
• Support governance, compliance and security initiatives for Cloud Services.
• Maintain inventory and posture of cloud resources from a security perspective.
• Collaborate with Infrastructure, Cloud, DevOps, and Security teams on secure solutions.

Conhecimentos

Cloud security

Incident response

Security monitoring

IaC security

Threat detection

DevSecOps

Detections engineering

MITRE ATT&CK for Cloud

Vulnerability management

Formação académica

Bachelor's degree in Information Security or related field

Ferramentas

AWS

Azure

Terraform

CloudFormation

S3

Redshift

Glue

Lambda

GuardDuty

Defender for Cloud

CloudTrail

CloudWatch

Splunk

Azure Sentinel

Descrição da oferta de emprego

• Lead the Cloud (AWS/Azure) Incident Detection and Response practice for the company, ensuring continuous visibility into the security posture of the environments
• Develop and maintain security controls in AWS and Azure environments, building baselines for cloud resources and compute functionalities (compute, storage, networking, containers, managed services)
• Monitor and improve the security posture of AWS data and infrastructure services such as S3, Redshift, Glue, Lambda, Step Functions, VPC and CloudWatch, identifying exposure risks, misconfigurations and misuse
• Protect cloud workloads, infrastructure and networks, covering containers/Kubernetes, VPC/VNet, segmentation and east‑west traffic
• Contribute to architecture decisions from a security perspective, including solution design, integration patterns and secure environment organization, in collaboration with Architecture and Engineering teams
• Develop and maintain security practices in IaC (Terraform or CloudFormation), including template scanning and compliance-as-code policies
• Perform hardening, vulnerability management and continuous security reviews of cloud environments
• Develop and operate cloud-specific detection cases (detection engineering), covering anomalous behaviors, insecure configurations and known exploitation techniques
• Integrate logs and telemetry from cloud services (CloudTrail, Azure Activity Log, GuardDuty, Defender for Cloud, CloudWatch, etc.) into Splunk, ensuring end-to-end detection coverage
• Participate in risk analyses, troubleshooting and incident response, conducting root cause analysis and containment with integrated work alongside CSIRT/SOC
• Translate technical findings into clear, actionable business risks, prioritizing remediation by criticality and actual exposure
• Produce technical and executive reports on security posture, detection gaps and the effectiveness of cloud controls
• Support governance, compliance and corporate security initiatives for Cloud Services, contributing to the maturity of the program
• Assist in monitoring, documenting and organizing cloud resources from a security perspective, keeping inventory and posture up to date
• Work collaboratively with Infrastructure, Cloud, DevOps and Security teams on configuration and implementation of secure solutions
• Operate in regulated and high‑criticality environments, aligned with industry requirements
• Participate in training and technical development programs related to cloud technologies and security
• Contribute to the evolution of the company's cloud security program, including detection and response automations (SOAR)

Requirements

• Bachelor’s degree in Information Security, Computer Science, Engineering, Information Systems or related fields
• Minimum 5 to 7 years of experience in Information Security, with at least 3 years focused on security, detection or incident response in cloud environments (AWS and/or Azure)
• Experience in complex, regulated and/or high‑criticality, distributed and/or multi‑cloud environments (retail is a plus)
• Advanced English for technical reading and interaction with international documentation/forums
• Cloud incident detection and response (AWS CloudTrail/GuardDuty, Azure Sentinel/Defender for Cloud, or equivalents)
• Definition and implementation of baselines and security controls for cloud services and resources (compute, storage, networking, containers, managed services)
• Security of AWS data and infrastructure services (S3, Redshift, Glue, Lambda, Step Functions, VPC, CloudWatch)
• Hardening and vulnerability management in cloud environments
• CSPM/CWPP: identification and remediation of misconfigurations and continuous hardening
• Container and Kubernetes security
• Cloud network security: VPC/VNet design, segmentation, Transit Gateway/PrivateLink, microsegmentation (e.g., Guardicore)
• IaC with Terraform or CloudFormation, including security scanning of templates
• Integration of cloud logs with SIEM (Splunk) and writing detections (SPL)
• DevSecOps: security in Azure DevOps/GitHub pipelines
• MITRE ATT&CK for Cloud as a reference for modeling detections

Core Competencies

Demonstrates expertise in Cloud Incident Detection and Response, focusing on AWS and Azure environments, with a strong emphasis on security controls, vulnerability management, and integration of cloud logs into SIEM systems. Proficient in developing security practices using Infrastructure as Code (IaC) and ensuring compliance in regulated environments.