Cybersecurity Analyst (AWS Cloud Security)

Barton Malow Builders; Southfield (MI); On-site; USD 80,000 - 110,000; Full time

Job summary

Barton Malow Builders in Michigan is seeking a Cybersecurity Analyst to contribute to a proactive cybersecurity program. You will respond to security events, help shape the cybersecurity roadmap, and keep stakeholders informed about threats and preventive measures.

The ideal candidate has strong foundations in cybersecurity, networking, and systems, with 2–3 years in security operations, incident response, or related fields, and experience with AWS security services and scripting.

Qualifications

• Bachelor's degree or equivalent work experience in cybersecurity or related field.
• 2–3 years of experience in security operations, vulnerability management, security engineering, incident response, or offensive security required.
• Experience with modern IT environments including cloud, servers, networking, and access controls.
• Working knowledge of AWS security fundamentals and core security services.

Responsibilities

• Investigate and respond to tickets from MDR provider.
• Engage in incident response and root-cause analysis.
• Perform internal security audits and identify weaknesses.
• Monitor AWS security, IAM, roles, permissions, and least-privilege controls.
• Analyze AWS logs (CloudTrail, GuardDuty, Security Hub, etc.) for threats.
• Educate users about security threats and best practices.
• Support vulnerability management and remediation tasks.
• Develop incident handling playbooks and procedures.
• Communicate with technical and non-technical teams effectively.
• Participate in tabletop exercises and threat simulations.
• Research and correlate events across data sources.
• Leverage AI/LLMs to identify and mitigate emerging risks.

Skills

Security operations

Incident response

Cloud security (AWS)

IAM & access management

Scripting (PowerShell/Python/Bash)

Communication skills

Education

Bachelor's degree in computer science, cybersecurity or related field

Tools

AWS CloudTrail

GuardDuty

Security Hub

Config

KMS

SIEM/MDR tools

Job description

The Cybersecurity Analyst is responsible for contributing to a variety of cybersecurity functions within the organization. This position is pivotal in maintaining and growing a proactive cybersecurity posture within the organization by promptly addressing security events, helping contribute to our cybersecurity roadmap, and ensuring that all stakeholders are well-informed about potential threats and preventive measures. The ideal candidate for this position is someone with a great technical foundation in cybersecurity, networking, and systems who is hungry to expand on their skills to contribute to an enterprise's overall cybersecurity program.

Key Job Responsibilities

• Investigate and respond to tickets generated by the organization's Managed Detection and Response (MDR) provider.
• Actively engage in incident response and root cause analysis. Participate in incident response activities to analyze and remediate cyber threats.
• Perform internal security audits to assess the organization's security posture, identify potential weaknesses, and recommend corrective measures.
• Monitor and assess the security of cloud environments (AWS), including review of IAM policies, roles, and permissions to enforce least-privilege access and identify misconfigurations or privilege escalation paths.
• Analyze cloud security telemetry — including AWS CloudTrail, GuardDuty, Security Hub, CloudFormation Guard and CloudWatch — to detect, investigate, and respond to suspicious activity and policy violations.
• Educate and raise awareness among the user community about various security threats, best practices, and measures to mitigate risk.
• Prioritize risk reduction and remediation tasks to support a vulnerability management program.
• Develop and maintain technical procedures and playbooks focused on incident handling.
• Communicate effectively with technical and non-technical teams while working to improve overall cybersecurity effectiveness.
• Participate in tabletop exercises designed to simulate potential cybersecurity incidents.
• Conduct research, analysis, and correlation of events across a wide variety of data sources.
• Demonstrate the ability to effectively leverage AI and LLMs to drive value while proactively identifying and mitigating emerging risks.

Required Knowledge, Education, Experience, Skills, And Abilities

• Bachelor's degree in computer science, cybersecurity or related field or equivalent work experience.
• 2-3 years of experience in security operations, vulnerability management, security engineering, incident response, or offensive security required.
• Conceptual and technical knowledge of modern IT environments such as server configuration/architecture, cloud, database management/configuration, networking protocols/designs, and access management/access controls.
• Working knowledge of AWS security fundamentals, including IAM (users, roles, policies, permission boundaries, and federation), the shared responsibility model, and core security services such as CloudTrail, GuardDuty, Security Hub, Config, and KMS.
• Familiarity with cloud identity and access management concepts — least-privilege design, role assumption (STS), policy evaluation logic, and detecting over-permissioned or stale credentials.
• Experience monitoring cloud environments for security events and correlating cloud logs with broader SIEM/MDR data sources is preferred.
• Strong technical skills with knowledge of a wide variety of tools, and technologies, and experience deploying and monitoring these capabilities to identify cyber threats.
• Knowledge of common cybersecurity frameworks and how to apply them, e.g., NIST 2.0 CSF, MITRE ATT&CK (including the ATT&CK Cloud matrix).
• Demonstrated interpersonal skills and ability to work effectively and collaboratively with a wide range of stakeholders.
• Demonstrated confidence and ease in delivering clear, effective verbal and written communication.
• Experience in scripting and programming languages such as PowerShell, Bash, or Python is preferred.
• Cybersecurity training or certifications from organizations such as CompTIA, TCM, SANS/GIAC, OffSec, ISC(2) is preferred; AWS certifications (e.g., AWS Certified Security – Specialty or Solutions Architect Associate) are a plus.