Senior Blue Team Analyst – Incident Response, Cloud Security

This is a fully remote position, open to applicants in Brazil.

📋 Description

• Oversee the technical response to incidents, managing the process from triage to containment, eradication, and post-incident analysis.

• Conduct investigations and forensic analysis across AWS environments, endpoints, and identity systems utilizing CloudTrail, GuardDuty, VPC Flow Logs, and IdP logs.

• Develop and maintain playbooks and runbooks, automating repetitive tasks.

• Facilitate incident communications as mandated by Central Bank regulations.

• Enhance AWS security posture through best practices in IAM and least privilege access, just-in-time access, WAF, network segmentation, and secrets management.

• Review and author secure Infrastructure as Code (IaC) using Terraform or similar tools in collaboration with SRE and engineering teams.

• Create and optimize detections for cloud threats, analyzing false-positive rates and coverage.

• Design internal tools and agents to streamline triage, alert enrichment, and incident response.

• Treat every tool as a product, defining the problem, target users, success metrics, and embracing iterative development.

• Share your creations to elevate the team’s technical capabilities.

• Collaborate with the engineering team to tackle cloud security challenges, serving as a technical expert in incident response.

• Build detections, automations, and internal products that significantly lower response times and mitigate risks.

• Leverage AI-assisted coding to achieve in weeks what previously took quarters.

• Report directly to the Head of Cyber Security.

⛳️ Requirements

• Demonstrated experience leading real-world incident response efforts, beyond merely theoretical exercises.

• Proven ability to secure AWS environments in production, encompassing IAM, CloudTrail, GuardDuty, Security Hub, VPC, and KMS.

• Proficient in programming daily with Python, Go, or TypeScript, with deployed code in production environments.

• Skilled in utilizing AI for development purposes, including coding assistants, agents, and LLMs via API.

• Proven history of creating a tool, automation, or product and evaluating its impact.

• Capable of independently managing a problem from diagnosis to delivery without external direction.

• Preferred: Experience within fintech, a payment institution, or a sector regulated by the Central Bank.

• Preferred: Background in detection engineering, including rules as code (Sigma, KQL, SPL, or similar) and log pipeline management.

• Preferred: Knowledge of infrastructure as code and Kubernetes.

• Preferred: Familiarity with endpoint and memory forensics, and understanding of EDR technologies.

• Preferred: Expertise in identity management and SSO, including SAML, OIDC, and conditional access.

• Preferred: Relevant certifications such as AWS Security Specialty, GCIH, or GCFA.

• Preferred: Contributions to open-source projects, security publications, or conference presentations.

🏝️ Benefits

• Contractor engagement model (PJ).

• Competitive compensation package.

• Comprehensive health insurance with 100% coverage for the employee and 75% coverage for the first dependent.

• Day off during the month of your birthday.

• Monthly discount coupon valid at stores accepting Pix Parcelado.

• Fully remote working arrangement.