Information Security Analyst - Cloud Security

We are seeking a hands-on Information Security Analyst - Cloud and Infrastructure Security to support the security, hardening, monitoring, and continuous improvement of enterprise cloud and infrastructure environments.

The role will focus on cloud security, infrastructure security, endpoint and workload protection, network security, security monitoring, incident investigation, system hardening, and security automation across enterprise environments.

The successful candidate will work closely with Cloud Infrastructure, Network, Platform Engineering, Security Operations, and IT Infrastructure teams to identify security risks, investigate security events, implement security controls, harden infrastructure, and improve the organization's overall security posture.

This is a technical Individual Contributor role for a security professional who enjoys building, securing, troubleshooting, monitoring, and hardening complex infrastructure environments at scale.

The candidate will have responsibilities across the following functions:

Cloud Security

• Implement and maintain security controls across GCP cloud environments.
• Perform cloud security assessments and identify misconfigurations, Excessive IAM permissions, publicly exposed services, Insecure network configurations, and weak security controls.
• Support implementation of cloud security baselines and guardrails.
• Monitor and improve cloud security posture using native and third-party security platforms.
• Perform security reviews of cloud infrastructure, services, and workloads.
• Support remediation and closure of cloud security findings.

GCP Security:

Hands-on experience with:

• Google Cloud IAM
• Security Command Centre (SCC)
• Cloud Armor
• Cloud KMS
• Cloud Logging
• Cloud Monitoring
• VPC
• Firewall Rules
• Load Balancers
• Cloud Run
• GKE
• Artifact Registry
• Service Accounts
• Workload Identity
• VPC Service Controls
• Responsibilities include reviewing access controls, network exposure, service configurations, logging, encryption, and security posture of GCP workloads.

Kubernetes / GKE Security:

• Perform security assessments and hardening of Kubernetes and GKE environments.
• Review Kubernetes configurations, workloads, namespaces, RBAC and service accounts.
• Implement and maintain:
• RBAC
• Network Policies
• Pod Security controls
• Admission Controllers
• OPA Gatekeeper
• Kyverno
• Identify insecure Kubernetes configurations and recommend remediation.
• Support container and workload security.
• Review exposed services, ingress configurations, secrets, privileges, and workload permissions.
• Troubleshoot Kubernetes security and infrastructure-related issues.

XDR / Endpoint and Workload Security:

• Monitor and investigate security events using XDR/EDR platforms such as CrowdStrike Falcon/XDR.
• Investigate suspicious:
• Processes
• Network connections
• Authentication activity
• Endpoint behavior
• Privilege escalation
• Malware indicators
• Persistence mechanisms
• Perform endpoint and workload investigations.
• Support threat hunting and incident investigation.
• Analyse endpoint telemetry and correlate events across cloud, infrastructure, and network environments.
• Assist with containment, remediation, and recovery activities during security incidents.
• Develop and tune detection rules and security monitoring use cases.

SIEM and Security Monitoring:

• Monitor security events through Chronicle SIEM and other security monitoring platforms.
• Investigate alerts and determine whether activity represents legitimate behaviour, misconfiguration, or a security incident.
• Perform log analysis and event correlation across:
• Cloud infrastructure
• Endpoints
• Network devices
• Kubernetes
• Identity systems
• Applications
• Support development and tuning of security detection use cases.
• Perform basic threat hunting based on indicators of compromise, attacker behaviour, and anomalous activity.
• Maintain investigation documentation and incident timelines.

Network Security and Troubleshooting:

• Support security and troubleshooting activities across enterprise network infrastructure.
• Investigate connectivity, routing, DNS, firewall, VPN, proxy, and TLS/SSL-related issues.
• Troubleshoot network communication between:
• Cloud workloads
• Kubernetes clusters
• Servers
• Applications
• Endpoints
• External services
• Analyse network traffic and identify abnormal or suspicious communication.
• Review firewall rules, network segmentation, security groups, routes, and exposed services.
• Support secure network architecture and segmentation.
• Troubleshoot connectivity issues involving VPC, VPN, firewalls, load balancers, proxies, and private connectivity.
• Use tools such as:
• Wireshark
• tcpdump
• Nmap
• curl
• netstat / ss
• traceroute
• nslookup / dig
• telnet / nc
• OpenSSL
• TLS diagnostic tools

Secure Remote Access and File Transfer Security:

• Manage and secure enterprise remote-access solutions such as Apache Guacamole.
• Implement secure authentication, authorisation, session controls, and access policies for remote infrastructure access.
• Monitor remote access activity and investigate suspicious sessions.
• Support secure file-transfer infrastructure such as SFTPGo.
• Configure and review:
• User access
• Authentication
• SSH keys
• Permissions
• IP restrictions
• Encryption
• File-transfer activity
• Investigate unauthorised or suspicious remote access and file-transfer activity.
• Ensure remote-access and file-transfer platforms follow enterprise security standards.

Infrastructure Hardening:

• Perform security hardening of Linux and Windows infrastructure.
• Implement and validate CIS Benchmark security controls.
• Identify insecure configurations and provide remediation recommendations.
• Harden:
• Operating systems
• Servers
• Virtual machines
• Containers
• Kubernetes nodes
• Network services
• Remote-access systems
• Review unnecessary services, ports, packages, protocols, accounts, and privileges.
• Support vulnerability remediation and configuration management.
• Conduct periodic security baseline assessments.

Golden Image Management:

• Design, maintain, and validate secure Golden Images for enterprise workloads.
• Harden operating system images according to organisational security standards and CIS benchmarks.
• Ensure Golden Images include:
• Secure OS configurations
• Required security agents
• Logging and monitoring
• Endpoint protection
• Vulnerability management agents
• Secure authentication
• Required security policies
• Perform security validation before images are released for enterprise use.
• Maintain version-controlled image baselines and security configurations.
• Periodically review and update images based on new vulnerabilities, security requirements, and OS updates.
• Support automated image creation and validation using tools such as Packer and Ansible.

Vulnerability and Security Assessment:

• Perform infrastructure and cloud vulnerability assessments.
• Analyse findings from vulnerability scanners, CSPM/CNAPP, XDR, and security platforms.
• Identify:
• Critical vulnerabilities
• OS vulnerabilities
• Misconfigurations
• Exposed services
• Weak protocols
• Weak cryptographic configurations
• Unsupported software
• Prioritise findings based on severity, exploitability, exposure, and business impact.
• Work with infrastructure teams to drive remediation.
• Validate security fixes and configuration changes.
• Track remediation progress and security posture improvements.

Threat Hunting and Incident Response/l

• Participate in security incident investigations across cloud, infrastructure, endpoint, and network environments.
• Perform threat hunting using:
• XDR telemetry
• SIEM logs
• Cloud logs
• Network telemetry
• Authentication events
• Investigate indicators of compromise and suspicious activity.
• Identify attacker techniques, persistence mechanisms, lateral movement, and privilege escalation.
• Support incident containment, eradication, and recovery.
• Perform root-cause analysis and recommend preventive controls.
• Document incidents, findings, and remediation actions.

Identity and Access Security:

• Review and monitor identity and access controls across cloud and infrastructure environments.
• Apply least privilege principles.
• Review:
• IAM roles
• Service accounts
• Privileged accounts
• SSH access
• Remote-access permissions
• Administrative access
• Identify excessive privileges and unauthorised access.
• Support Zero Trust and identity-centric security controls.
• Investigate suspicious authentication and privilege-related events.

Security Automation and Scripting:

• Automate repetitive security and infrastructure tasks.
• Develop scripts for:
• Security assessments
• Configuration validation
• Log analysis
• Vulnerability reporting
• Hardening validation
• Security monitoring
• Experience with one or more:
• Python
• Bash
• PowerShell
• Go
• Automate security checks and operational workflows where appropriate.

The core requirements for the job include the following:

Cloud Security:

• Strong hands-on knowledge of GCP Security.
• Understanding of AWS and Azure security fundamentals.
• Experience with:
• IAM
• SCC
• Cloud Armor
• KMS
• VPC
• Firewall
• Logging and Monitoring
• GKE
• Cloud Run
• Load Balancers
• Service Accounts

Infrastructure Security:

• Strong understanding of Linux and/or Windows security.
• Experience with server hardening and vulnerability remediation.
• Knowledge of CIS Benchmarks.
• Experience with Golden Images and infrastructure baseline management.
• Knowledge of Packer, Ansible, or equivalent tools is preferred.

Network Security:

• Strong networking fundamentals.
• Understanding of TCP/IP, DNS, HTTP/HTTPS, TLS, routing, VPNs, firewalls, proxies, and network segmentation.
• Ability to troubleshoot complex network connectivity and security issues.
• Experience with network troubleshooting tools.

XDR / SIEM:

• Experience with CrowdStrike Falcon/XDR or equivalent XDR/EDR platform.
• Experience with Chronicle SIEM or equivalent SIEM platform.
• Understanding of security monitoring, alert investigation, threat hunting, and incident response.

Remote Access and File Transfer:

• Experience securing remote-access technologies such as Apache Guacamole.
• Experience with secure file-transfer platforms such as SFTPGo or equivalent SFTP solutions.
• Understanding of SSH, certificates, keys, authentication, authorisation, and secure file transfer.

Kubernetes Security:

• Hands-on experience with Kubernetes / GKE security.
• Knowledge of:
• RBAC
• Network Policies
• Pod Security
• Admission Controllers
• OPA Gatekeeper
• Kyverno
• Container security

Security Engineering:

• Vulnerability assessment and remediation.
• Threat modelling and security assessments.
• Incident investigation.
• Threat hunting.
• Security monitoring.
• Infrastructure hardening.
• Security automation.

Good to Have:

• Experience with Zscaler ZPA / ZIA.
• Experience with Akamai WAF or other enterprise WAF technologies.
• Experience with OpenSCAP.
• Experience with Packer and Ansible.
• Knowledge of cloud-native workload protection.
• Experience with CSPM/CNAPP platforms.
• Knowledge of Zero Trust Architecture.
• Experience with network packet analysis.
• Knowledge of security architecture and infrastructure design.
• Experience with security policy enforcement and compliance frameworks.
• Good-to-have certifications such as:
• Google Professional Cloud Security Engineer
• CKA / CKS / KCNA
• Security+
• CCSP
• CISSP
• GIAC certifications

Experience:

• 3-6 years of experience in Information Security, Cloud Security, Infrastructure Security, Security Operations, Network Security, or a related domain.
• Candidates should demonstrate practical experience in several of the following areas:
• GCP Security
• Cloud Infrastructure Security
• Kubernetes / GKE Security
• XDR / EDR
• SIEM
• Network Security
• Infrastructure Hardening
• Golden Image Management
• Vulnerability Management
• Threat Hunting
• Incident Response
• Remote Access Security
• Secure File Transfer
• Security Automation

Skills

CrowdStrike, EDR, Falcon, GCP, GKE, Google Cloud, Kubernetes, XDR