Cyber Security Analyst

Kellermeyer Bergensons Services (KBS) is the largest privately held provider of facility services in North America, and they are seeking a Cyber Security Analyst to monitor, investigate, and respond to security threats across their networks, endpoints, and cloud environments. The role involves proactive threat hunting, analytics, and automation to enhance the company's security posture.

Responsibilities:

• Apply AWS security best practices across identity, network, workload, and data services, covering areas such as IAM roles and permission scoping, VPC and edge controls, container and serverless compute, storage and databases, and encryption and key management, assessed against the AWS Well-Architected Security Pillar
• Own AWS security posture, creating platform visibility through the SIEM and driving measurable improvement over time, working with Software Engineering, DevOps, and other stakeholders to see that security requirements are implemented to standard
• Configure and tune Microsoft 365 security capabilities across endpoint, identity, email, and data protection, including the Defender suite, Purview data protection and insider risk management, and Entra ID access controls such as Conditional Access and privileged access
• Actively hunt for indicators of compromise, suspicious activity, and adversarial behavior across endpoint, identity, email, network, and cloud environments using CrowdStrike and other EDR/XDR platforms, escalating or remediating as appropriate
• Identify repetitive security operations work and automate it across detection, control enforcement, and response using SOAR, Python, PowerShell, or infrastructure as code
• Develop and execute CQL and KQL queries and build dashboards to analyze telemetry from Microsoft, CrowdStrike, AWS, and related sources
• Participate in red/blue team exercises, simulations, and post-incident reviews to identify and reduce areas of vulnerability/exposure and improve readiness
• Create and improve security baselines, detection rules, and playbooks to enhance visibility and reduce response time
• Prepare reports and documentation on incidents, improvements, and overall security posture
• Ensure alignment with internal policies, industry standards, and relevant security frameworks
• Stay current on new platform capabilities and emerging attack vectors, applying a proactive, inquisitive, and analytical mindset to surface overlooked threats

Requirements:

• 5+ years' experience in the information security field
• Hands-on AWS security configuration experience across identity, network, and data services is required
• Advanced working knowledge of Microsoft 365 security and compliance across identity, endpoint, email, and collaboration workloads
• Able to present platform options and tradeoffs and commit to a clear recommendation
• Hands-on experience using CQL to build queries and dashboards is required
• Working knowledge of KQL
• EDR/XDR and SIEM platforms (CrowdStrike, Microsoft Defender), plus email security platforms (Abnormal Security)
• Experience with Python or PowerShell scripting for automation and incident enrichment, and with infrastructure as code for configuration enforcement
• Threat intelligence, vulnerability management, and incident response methodologies
• Understanding of common threat frameworks (MITRE ATT&CK, Cyber Kill Chain)
• Analytical and detail-oriented with strong problem-solving ability
• Self-motivated and dependable, working effectively with minimal supervision
• Collaborative communicator with cross-departmental awareness
• Curious and proactive, committed to continuous learning and process improvement
• Bachelor's degree in a computer-related field, such as cybersecurity, software information assurance, computer science, or an educational equivalent
• Background in solutions architecture or systems engineering, with demonstrated ability to select among available platform services rather than only operate a fixed configuration
• Certifications preferred (nice to have): AWS: Certified Security – Specialty, and Certified Solutions Architect (Associate or Professional). Microsoft: SC-100 Cybersecurity Architect Expert, SC-200 Security Operations Analyst, AZ-500 Azure Security Engineer or its successor SC-500 Cloud and AI Security Engineer, AZ-305 Azure Solutions Architect Expert