Cloud Security Analyst (Remote)

About KnowBe4

Join the cybersecurity company that puts security first; literally and without compromise. At KnowBe4, our AI-driven Human Risk Management platform empowers over 70,000 organizations worldwide to strengthen their security culture and transform their workforce from their biggest vulnerability into their strongest security asset. As the undisputed industry standard with unusually high customer retention rates and recognition as a Leader by G2 and TrustRadius, we're not just providing security awareness training - we're redefining what it means to be a trusted security partner in an increasingly complex threat landscape.

Our team values radical transparency, extreme ownership, and continuous professional development in a welcoming workplace that encourages all employees to be themselves. Whether working remotely or in-person, we strive to make every day fun and engaging; from team lunches to trivia competitions to local outings, there is always something exciting happening at KnowBe4.

Remote positions open to the US only. 

Join our Information Security team as the person responsible for monitoring and protecting KnowBe4's cloud infrastructure. As Cloud Security Analyst, you'll be the first responder for security alerts across our AWS and Azure environments; triaging, investigating, and coordinating responses that protect both company and customer data. You'll own the day-to-day security operations that keep our cloud ecosystem secure: analyzing alerts, hunting threats, investigating incidents, and partnering with engineering teams to ensure vulnerabilities get fixed before they become problems. The successful candidate stays calm under pressure, stays curious about new attack vectors, builds tools to make their job easier, and is passionate about cybersecurity.

Security Monitoring & Response: Continuously monitor and triage alerts from SIEM, CSPM, CWPP, and cloud security tools  - identifying what's a real threat, what needs immediate action, and what requires deeper investigation.

Incident Management: Serve as primary responder for cloud security incidents, leading investigation efforts from initial detection through containment, eradication, and recovery while keeping stakeholders informed throughout.

Threat Hunting & Analysis: Proactively hunt for threats across security log feeds, perform root cause analysis on vulnerabilities and incidents, and stay ahead of emerging attack patterns using frameworks like MITRE ATT&CK.

Alert Engineering: Build and refine security alerts and dashboards that catch the signals that matter - reducing noise while ensuring critical issues surface quickly and clearly.

Security Testing & Validation: Conduct security reviews and penetration testing across cloud infrastructure, identifying weaknesses before attackers do and validating that our defenses actually work.

Cross-Team Collaboration: Partner closely with IT, engineering, and development teams to ensure security findings are understood, prioritized appropriately, and remediated with solid engineering principles—not just quick fixes.

2+ years of hands-on experience in cloud security, information security operations, or similar roles where you've monitored alerts, investigated incidents, and worked within AWS and/or Azure environments.

Practical cloud security knowledge with demonstrated ability to navigate cloud environments, understand misconfigurations, and think like an attacker to anticipate where vulnerabilities hide.

Builder mindset with AI-assisted development skills -you actively leverage AI tools to write scripts, automate repetitive tasks, and solve your own problems rather than waiting for someone else to build solutions for you.

Security operations foundation -you understand how to triage alerts, distinguish true positives from noise, investigate incidents methodically, and communicate findings clearly to both technical and non-technical audiences.

Strong organizational skills and time management -you can juggle multiple security investigations simultaneously, prioritize what needs attention now versus what can wait, and keep track of incidents through resolution without dropping details.

Some experience with offensive security - you know your way around infosec testing tools, understand OWASP Top 10, can think through how attackers exploit cloud environments, and have some exposure to penetration testing concepts.

Comfort across technical domains -  basic scripting ability, Linux command line navigation, understanding of application concepts (APIs, containers, databases), and some experience working with infrastructure-as-code tools like Terraform or CloudFormation.

Cloud security certifications (AWS Security Specialty, Azure Security Engineer, or similar professional credentials that validate your expertise).

Bachelor's degree in information security, information systems, computer science, or related technical field.

Experience with MITRE ATT&CK Framework in practical incident response scenarios where you've mapped adversary techniques to actual alerts.

Background deploying security tooling as code - building alerts, automation, or security solutions using proper engineering principles that others can actually use and maintain.

Builder-Friendly Culture: We encourage you to solve your own problems with good engineering principles; everything is deployed through Terraform, following the same standards as our development teams—you'll write solutions that scale, not just quick scripts.

Remote Flexibility: Fully remote position open across the US, giving you the autonomy to work where you're most effective while staying connected to a collaborative security team.

Continuous Learning: Budgets for certifications, conferences, and dedicated exploration time to research new tools and stay current

Transparency and Trust: Radical candor, low ego, high accountability

Global Scale: Your work will help protect users across 70,000+ organizations worldwide.

The base pay for this position ranges from $80,000 - $85,000, which will vary depending on how well an applicant's skills and experience align with the job description listed above.

We will accept applications until 12/30/2025.