Cybersecurity Analyst

Covalent Resource Group; Southfield (MI); On-site; USD 90,000 - 130,000; Full time

Job summary

Covalent Resource Group is seeking a Cybersecurity Analyst in Southfield, MI to help strengthen our proactive security posture across cloud, on-prem, and CI/CD pipelines. You will review IaC, build guardrails, and collaborate with engineering to remediate findings, while expanding your DevSecOps experience.

You’ll analyze cloud telemetry, participate in incident response, and educate teams on threats, leveraging AI/LLMs to identify risks.

Qualifications

• Bachelor's degree in computer science, cybersecurity, or related field, or equivalent work experience.
• 2-3 years of experience in security operations, vulnerability management, security engineering, cloud security, DevSecOps, incident response, or offensive security.
• Knowledge of modern IT environments: servers, cloud, databases, networking, and access controls.
• Working knowledge of AWS security fundamentals: IAM (users, roles, policies, permission boundaries, federation), the shared responsibility model, and CloudTrail, GuardDuty, Security Hub, Config, and KMS.
• Familiarity with least-privilege design, role assumption (STS), policy evaluation logic, and detecting over-permissioned or stale credentials.
• Knowledge of NIST CSF 2.0 and MITRE ATT&CK (including the Cloud matrix).
• Familiarity with Git and CI/CD concepts, and the ability to read Terraform and spot insecure configurations.
• Strong technical skills, interpersonal skills, and clear verbal and written communication.

Responsibilities

• Review Terraform code and pull requests for security misconfigurations and help build guardrails into infrastructure-as-code workflows.
• Help integrate automated security checks (IaC, dependency, secrets, code scanning) into GitHub Actions pipelines and work with engineering teams to remediate findings.
• Prioritize remediation for the vulnerability management program using Tenable for infrastructure, web application, and cloud (CNAPP) findings.
• Investigate and respond to tickets from the Managed Detection and Response (MDR) provider.
• Participate in incident response and root cause analysis to analyze and remediate cyber threats.
• Perform internal security audits to identify weaknesses and recommend corrective measures.
• Assess the security of AWS environments, including review of IAM policies, roles, and permissions to enforce least privilege and identify misconfigurations or privilege escalation paths.
• Analyze cloud telemetry (CloudTrail, GuardDuty, Security Hub, CloudFormation Guard, CloudWatch) to detect, investigate, and respond to suspicious activity and policy violations.
• Automate repetitive security tasks with scripts and pipeline-based workflows.
• Educate users on security threats; develop incident handling playbooks and participate in tabletop exercises.
• Research and correlate events across a wide variety of data sources and communicate clearly with technical and non-technical team.
• Leverage AI and LLMs to drive value while proactively identifying and mitigating emerging risks.

Skills

Cybersecurity

Cloud security

DevSecOps

Incident response

Education

Bachelor's degree or equivalent

Tools

Terraform

GitHub Actions

Tenable

AWS IAM

Job description

POSITION SUMMARY:

The Cybersecurity Analyst contributes to a variety of cybersecurity functions, helping maintain a proactive security posture by promptly addressing security events, contributing to the cybersecurity roadmap, and keeping stakeholders informed about threats and preventive measures. The role also supports building security into how they deploy cloud infrastructure, including GitHub Actions pipelines and Terraform-managed AWS resources. The ideal candidate has a great technical foundation in cybersecurity, networking, and systems and is hungry to expand their skills, including exposure to DevSecOps practices, to contribute to an enterprise cybersecurity program.

KEY JOB RESPONSIBILITIES:

• Review Terraform code and pull requests for security misconfigurations and help build guardrails into infrastructure-as-code workflows.
• Help integrate automated security checks (IaC, dependency, secrets, code scanning) into GitHub Actions pipelines and work with engineering teams to remediate findings.
• Prioritize remediation for the vulnerability management program using Tenable for infrastructure, web application, and cloud (CNAPP) findings.
• Investigate and respond to tickets from the Managed Detection and Response (MDR) provider.
• Participate in incident response and root cause analysis to analyze and remediate cyber threats.
• Perform internal security audits to identify weaknesses and recommend corrective measures.
• Assess the security of AWS environments, including review of IAM policies, roles, and permissions to enforce least privilege and identify misconfigurations or privilege escalation paths.
• Analyze cloud telemetry (CloudTrail, GuardDuty, Security Hub, CloudFormation Guard, CloudWatch) to detect, investigate, and respond to suspicious activity and policy violations.
• Automate repetitive security tasks with scripts and pipeline-based workflows.
• Educate users on security threats; develop incident handling playbooks and participate in tabletop exercises.
• Research and correlate events across a wide variety of data sources and communicate clearly with technical and non-technical team.
• Leverage AI and LLMs to drive value while proactively identifying and mitigating emerging risks.

REQUIRED KNOWLEDGE, EDUCATION, EXPERIENCE, SKILLS, AND ABILITIES:

• Bachelor's degree in computer science, cybersecurity, or a related field, or equivalent work experience.
• 2-3 years of experience in security operations, vulnerability management, security engineering, cloud security, DevSecOps, incident response, or offensive security.
• Knowledge of modern IT environments: servers, cloud, databases, networking, and access controls.
• Working knowledge of AWS security fundamentals: IAM (users, roles, policies, permission boundaries, federation), the shared responsibility model, and CloudTrail, GuardDuty, Security Hub, Config, and KMS.
• Familiarity with least-privilege design, role assumption (STS), policy evaluation logic, and detecting over-permissioned or stale credentials.
• Knowledge of NIST CSF 2.0 and MITRE ATT&CK (including the Cloud matrix).
• Familiarity with Git and CI/CD concepts, and the ability to read Terraform and spot insecure configurations.
• Strong technical skills, interpersonal skills, and clear verbal and written communication.

NICE TO HAVE:

• Experience monitoring cloud environments and correlating cloud logs with SIEM/MDR data.
• Scripting in PowerShell, Bash, or Python.
• Hands-on experience with GitHub Actions, Terraform, and Tenable or comparable vulnerability, web application, and CNAPP tools.
• Familiarity with secure SDLC and the OWASP Top 10.
• Understanding of non-human and AI agent identity security, including how service accounts, roles, OIDC-federated pipeline identities, and AI agents authenticate, what access they hold, and how to enforce least privilege and lifecycle controls.
• Certifications from CompTIA, TCM, SANS/GIAC, OffSec, or ISC(2); AWS certifications (Security - Specialty, Solutions Architect Associate) are a plus.

This position is not eligible for visa sponsorship (e.g., H-1B). Applicants must be currently authorized to work in the United States on a permanent basis and reside within a reasonable commuting distance of Southfield, Michigan.