AI and Cloud Security Analyst

About the Role

The AI and Cloud Security Analyst provides day-to-day L2 coverage of the AI security detection fabric, triaging and supporting investigations of AI-specific detections. This role is crucial for maintaining the runtime-first security model, intercepting, analyzing, and enforcing security at the moment of execution.

Key Responsibilities

• Provide L2 coverage of the AI Security toolset:
• Monitor AI security detections across runtime defense/AIDR events, intent and behavioral anomalies, model-level detections, and adversarial-testing signals.
• Validate detections, classify severity and impact, propose and implement policy updates.
• Escalate complex cases to L3 with complete, reusable context.
• Investigate AI-specific events across all five AI archetypes:
• Analyze direct and indirect prompt injection, jailbreaks, sensitive-data leakage, RAG poisoning indicators, unauthorized MCP/tool activity, agent hijacking, and rogue or overprivileged agent behavior.
• Utilize prompt/response logs, decision traces, identity context, and agent inventory data for investigations.
• Support the AI asset-intelligence layer:
• Assist in maintaining agent inventory hygiene, ownership attribution, MCP registry accuracy, and risk-scoring context.
• Perform data analytics:
• Query and correlate AI and security telemetry using KQL (and/or SQL).
• Identify anomalies and attack patterns.
• Build and maintain dashboards tracking key program metrics, including detection volumes, runtime containment rate, mean time to detect/contain/resolve, agent-visibility coverage, approval-SLA performance, and top policy-violation categories.
• Provide tuning recommendations back to the L3 engineer.
• Produce OCR (operational, compliance, and risk) reporting:
• Generate recurring dashboards and executive summaries communicating AI-security posture, KPIs, and trends.
• Support automated NIST AI RMF compliance evidence generation and audit/regulatory reporting, including EU AI Act-related evidence for EU scope.
• Maintain rigorous case documentation and shift/handover notes.
• Contribute observed patterns to detection-rule tuning, runbook refinement, and the closed-loop improvement cycle.
• Build working fluency in the OWASP Top 10 for LLM Applications 2025, the OWASP Top 10 for Agentic Applications, and MITRE ATLAS.
• Monitor and triage cloud security alerts across Azure, AWS, and GCP:
• Review misconfigurations, security risks, exposed resources, excessive permissions, and workload threats from the company CSPM platform.
• Route, remediate, or escalate alerts per playbook.
• Support cloud compliance monitoring and reporting against CIS Benchmarks and NIST 800-53 r5 / CSF 2.0 baselines.
• Track remediation to closure and integrate cloud posture into consolidated OCR reporting.
• Support L3 engineer with policy updates.
• Assist with cloud workload vulnerability triage (VMs, containers, images).
• Review Microsoft 365 / Google Workspace security signals.
• Partner with the L3 engineer, SOC, cloud teams, and incident responders on investigations and enrichment spanning cloud, identity, endpoint, and AI telemetry.

Requirements & Tech Stack

• Solid security operations fundamentals: alert monitoring, triage, validation, incident classification, escalation, and case management against SLAs, working from runbooks in a follow-the-sun/handover model.
• Strong data analytics and reporting: KQL (and/or SQL) for querying and correlation; dashboard and report development; the ability to turn telemetry into clear, decision-ready operational, compliance, and risk reporting.
• Foundational AI/GenAI security awareness: LLM risks (prompt injection, jailbreaks, data leakage), agentic AI and MCP concepts, AI guardrails, and familiarity with the OWASP LLM Top 10 and MITRE ATLAS.
• Working knowledge of cloud security in at least one of Azure/AWS/GCP (multi-cloud exposure preferred), including CSPM/CWPP concepts and cloud identity basics.
• Scripting for automation and enrichment (PowerShell and/or Python).
• Familiarity with CIS Benchmarks and NIST (800-53, CSF).
• Analytical rigor, attention to detail, and clear English communication.

Qualifications

• Experience in a SOC, security operations, cloud security, or security analyst role with hands-on monitoring, triage, and investigation experience.
• Demonstrable experience producing analytics, dashboards, and reporting from security telemetry for technical and executive audiences.
• Experience supporting compliance or audit evidence collection (NIST, CIS, ISO, or similar) is a plus.
• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or equivalent practical experience.
• Awareness of NIST AI RMF and the EU AI Act is beneficial.
• Exposure to AI security platforms is a strong plus.
• Exposure to AI/GenAI security is an advantage.
• Certifications are an advantage, not mandatory: CompTIA Security+, CySA+, SC-200, SC-900, AZ-500, AWS or GCP security/foundational credentials; AI-security coursework or credentials are a plus.

Working Conditions

• Willingness to work nonstandard business hours for projects, business impact issues, and incident response.
• Some travel required.
• Flexible remote work.