Fast Facts

Join KnowBe4 as a Cloud Security Analyst, responsible for monitoring and protecting cloud infrastructure while leading incident response across AWS and Azure environments.

Responsibilities: Monitor and triage alerts from various security tools, respond to incidents, proactively hunt for threats, perform security testing, and collaborate with engineering teams to address vulnerabilities.

Skills: 2+ years of experience in cloud security, knowledge of AWS/Azure, incident investigation, threat hunting, and scripting capabilities; familiarity with security frameworks like MITRE ATT&CK is a plus.

Qualifications: Preferred qualifications include cloud security certifications, a degree in a related technical field, and experience with security tooling and incident response.

Location: This is a fully remote position available to candidates based in the US.

Compensation: $80000 - $85000 / Annually

Remote positions open to the US only. 

The Opportunity

Join our Information Security team as the person responsible for monitoring and protecting KnowBe4's cloud infrastructure. As Cloud Security Analyst, you'll be the first responder for security alerts across our AWS and Azure environments; triaging, investigating, and coordinating responses that protect both company and customer data. You'll own the day-to-day security operations that keep our cloud ecosystem secure: analyzing alerts, hunting threats, investigating incidents, and partnering with engineering teams to ensure vulnerabilities get fixed before they become problems. The successful candidate stays calm under pressure, stays curious about new attack vectors, builds tools to make their job easier, and is passionate about cybersecurity.

What You'll Do

Security Monitoring & Response: Continuously monitor and triage alerts from SIEM, CSPM, CWPP, and cloud security tools - identifying what's a real threat, what needs immediate action, and what requires deeper investigation.

Incident Management: Serve as primary responder for cloud security incidents, leading investigation efforts from initial detection through containment, eradication, and recovery while keeping stakeholders informed throughout.

Threat Hunting & Analysis: Proactively hunt for threats across security log feeds, perform root cause analysis on vulnerabilities and incidents, and stay ahead of emerging attack patterns using frameworks like MITRE ATT&CK.

Alert Engineering: Build and refine security alerts and dashboards that catch the signals that matter - reducing noise while ensuring critical issues surface quickly and clearly.

Security Testing & Validation: Conduct security reviews and penetration testing across cloud infrastructure, identifying weaknesses before attackers do and validating that our defenses actually work.

Cross-Team Collaboration: Partner closely with IT, engineering, and development teams to ensure security findings are understood, prioritized appropriately, and remediated with solid engineering principles—not just quick fixes.

What You Bring

2+ years of hands-on experience in cloud security, information security operations, or similar roles where you've monitored alerts, investigated incidents, and worked within AWS and/or Azure environments.

Practical cloud security knowledge with demonstrated ability to navigate cloud environments, understand misconfigurations, and think like an attacker to anticipate where vulnerabilities hide.

Builder mindset with AI-assisted development skills -you actively leverage AI tools to write scripts, automate repetitive tasks, and solve your own problems rather than waiting for someone else to build solutions for you.

Security operations foundation -you understand how to triage alerts, distinguish true positives from noise, investigate incidents methodically, and communicate findings clearly to both technical and non-technical audiences.

Strong organizational skills and time management -you can juggle multiple security investigations simultaneously, prioritize what needs attention now versus what can wait, and keep track of incidents through resolution without dropping details.

Some experience with offensive security - you know your way around infosec testing tools, understand OWASP Top 10, can think through how attackers exploit cloud environments, and have some exposure to penetration testing concepts.

Comfort across technical domains -  basic scripting ability, Linux command line navigation, understanding of application concepts (APIs, containers, databases), and some experience working with infrastructure-as-code tools like Terraform or CloudFormation.

Bonus points if you have:

Cloud security certifications (AWS Security Specialty, Azure Security Engineer, or similar professional credentials that validate your expertise).

Bachelor's degree in information security, information systems, computer science, or related technical field.

Experience with MITRE ATT&CK Framework in practical incident response scenarios where you've mapped adversary techniques to actual alerts.

Background deploying security tooling as code - building alerts, automation, or security solutions using proper engineering principles that others can actually use and maintain.

Why You'll Love It Here

Builder-Friendly Culture: We encourage you to solve your own problems with good engineering principles; everything is deployed through Terraform, following the same standards as our development teams—you'll write solutions that scale, not just quick scripts.

Remote Flexibility: Fully remote position open across the US, giving you the autonomy to work where you're most effective while staying connected to a collaborative security team.

Continuous Learning: Budgets for certifications, conferences, and dedicated exploration time to research new tools and stay current

Transparency and Trust: Radical candor, low ego, high accountability

Global Scale: Your work will help protect users across 70,000+ organizations worldwide.

The base pay for this position ranges from $80,000 - $85,000, which will vary depending on how well an applicant's skills and experience align with the job description listed above.

We will accept applications until 12/30/2025.