AI and Cloud Security Analyst

Responsibilities

• L2 coverage of the AI Security toolset . Monitor AI security detections across the detection fabric — runtime defense/AIDR events, intent and behavioral anomalies, model-level detections, and adversarial-testing signals. Validate detections, classify severity and impact, propose and implement policy updates, and escalate complex cases to L3 with complete, reusable context.
• Investigate AI-specific events across all five AI archetypes (embedded SaaS copilots, low-code/no-code agents, homegrown agentic pipelines, device-based coding agents, homegrown models): direct and indirect prompt injection, jailbreaks, sensitive-data leakage, RAG poisoning indicators, unauthorized MCP/tool activity, agent hijacking, and rogue or overprivileged agent behavior — using prompt/response logs, decision traces, identity context, and agent inventory data.
• Support the AI asset-intelligence layer : help maintain agent inventory hygiene, ownership attribution, MCP registry accuracy, and risk-scoring context that feeds runtime enforcement decisions and fast-track approval workflows.
• Data analytics . Query and correlate AI and security telemetry (KQL), identify anomalies and attack patterns, and build/maintain dashboards tracking the program's key metrics — detection volumes, runtime containment rate, mean time to detect/contain/resolve, agent-visibility coverage, approval-SLA performance, and top policy-violation categories — feeding tuning recommendations back to the L3 engineer.
• OCR reporting (operational, compliance, and risk) . Produce recurring dashboards and executive summaries communicating AI-security posture, KPIs, and trends to stakeholders and control owners; support automated NIST AI RMF compliance evidence generation and audit/regulatory reporting, including EU AI Act–related evidence for EU scope.
• Maintain rigorous case documentation and shift/handover notes; contribute observed patterns to detection-rule tuning, runbook refinement, and the closed-loop improvement cycle (red-team findings → policy and detection updates → re-test validation).
• Build working fluency in the OWASP Top 10 for LLM Applications 2025, the OWASP Top 10 for Agentic Applications, and MITRE ATLAS as the shared investigation taxonomy.
• Monitor and triage cloud security alerts across Azure, AWS, and GCP from company CSPM platform — misconfigurations, security risks, exposed resources, excessive permissions, workload threats — and route, remediate, or escalate per playbook.