Senior Cloud Security Analyst

As a Senior Cloud Security Operations Analyst, you will play a critical role in ensuring the confidentiality, integrity, and availability of Pega's commercial cloud infrastructure and assets. You will be key in the continuous monitoring and protection of all global cloud security operations at Pega as well as an active participant in incident response efforts. As a key member of a team consisting of highly capable and talented problem-solving analysts and engineers, you'll help develop processes that drive proactive, automated detection and incident response tactics to support the quick resolution of cloud security events and incidents.

You will accomplish this by collaborating with cross-functional teams, including other security analysts, threat detection engineers, vulnerability analysts, security engineers, system administrators, and developers, to proactively identify potential security risks and vulnerabilities within our cloud environment. You will leverage your strong analytical skills to assess and prioritize threats, applying your knowledge of industry best practices and cloud security frameworks. As a senior cloud security operations analyst at Pega, you'll contribute to the success of our globally recognized brand. Your efforts will directly impact the security and trust our clients place in us, as we help them transform their business processes and drive meaningful digital experiences.

Responsibilities:

• Perform security monitoring of Pega Cloud commercial environments using multiple security tools/dashboards.
• Perform security investigations to identify indicators of compromise (IOCs) and better protect Pega Cloud and our clients from unauthorized or malicious activity.
• Actively contribute to incident response activities as we identify, contain, eradicate, and recover.
• Contribute to standard operating procedure (SOP) and policy development for CSOC detection and analysis tools and methodologies.
• Assist in enhancing security incident response plans, conducting thorough investigations, and recommending remediation measures to prevent future incidents.
• Perform threat hunts for adversarial activities within Pega Cloud to identify evidence of attacker presence that may not have been identified by existing detection mechanisms
• Assist the threat detection team in developing high-confidence Splunk notables focused on use cases for known and emerging threats, based on hypotheses derived from the Pega threat landscape.
• Assist in the development of dashboards, reports, and other non-alert-based content to maintain and improve situational awareness of Pega Cloud's security posture.
• Assist in the development of playbooks for use by analysts to investigate both high-confidence and anomalous activity.

Requirements:

• Minimum of 4+ years of industry-relevant experience, with a demonstrated working knowledge of cloud architecture, infrastructure, and resources, along with the associated services, threats, and mitigations.
• Minimum of 2+ years in operational SIEM (Security Information and Event Management) roles, focusing on analysis, investigations, and incident response, with experience in Google Chronicle SIEM being an added advantage.
• 2+ years of operational cloud security experiencepreferably AWS and/or GCPincluding knowledge and analysis of various cloud logs such as CloudTrail, Cloud Audit, GuardDuty, Security Command Center, CloudWatch, Cloud Ops, Trusted Advisor, Recommender, VPCFlow, and WAF logs. 2+ years of operational experience with EDR/XDR platforms and related analysis and response techniques.
• Operational experience performing investigations and incident response within Linux and Windows hosts as well as AWS, GCP, and related Kubernetes environments (EKS/GKE).
• Solid working knowledge of the MITRE ATT& CK framework and the associated TTPs and how to map detections against it, particularly the cloud matrix portion
• Familiarity with the OWASP Top 10 vulnerabilities and best practices for mitigating these security risks.
• A solid foundational understanding of computers, OS (Linux/Windows), and network architecture concepts, and various related exploits/attacks.
• Experience developing standard operating procedures (SOPs), incident response plans, runbooks/playbooks for repeated actions, and security operations policies.
• Experience with Python, Linux shell/bash, and PowerShell scripting is a plus.
• Excellent verbal and written communication skills, including poise in high-pressure situations.
• A demonstrated ability to work in a team environment and foster a healthy, productive team culture.
• A bachelor's degree in cybersecurity, computer science, data science, or a related field.

Skills

AWS, Docker, EDR, SIEM, XDR, kubernetes