Cybersecurity Analyst, Mid-Level

• Define and maintain secure configuration standards for cloud environments, servers, workstations, and network devices.
• Implement and monitor perimeter and access protection controls, including WAF, API protection, Zero Trust, MFA, and network segmentation.
• Manage infrastructure vulnerability and patch programs, tracking coverage by EDR, antimalware, and MDM tools.
• Ensure immutable backups are in place and restoration tests are performed, while supporting the encryption of sensitive data.
• Integrate cloud and infrastructure logs with the SIEM and support incident triage and response alongside the outsourced monitoring service (MDR).
• Produce evidence for audits, ISO 27001 certification, and customer due diligence processes.
• Monitor security metrics and document implemented standards, exceptions, and controls.
• Partner with Infrastructure, Platform Engineering, and IT teams to contribute to measurable, documented, and auditable controls.

• 3–5 years of experience in infrastructure or cloud security, or in infrastructure and SRE with a security focus.
• Hands-on experience with Google Cloud Platform (GCP), including IAM, VPC, firewall rules, Cloud Logging, and KMS.
• Knowledge of networking, including TCP/IP, DNS, firewalls, segmentation, and VPNs.
• Experience with hardening and CIS benchmarks in Linux and Windows environments.
• Experience with WAF and API protection.
• Knowledge of vulnerability and patch management.
• Familiarity with infrastructure as code and scripting in Python, Bash, or PowerShell.
• Knowledge of ISO 27001, CIS Controls, or NIST CSF.
• Strong written communication skills for documenting standards, exceptions, and evidence.
• Certifications such as Google Professional Cloud Security Engineer, CCSK, Security+, or CKS are a plus.
• Experience with CSPM, Cloudflare Zero Trust, pfSense, Kaspersky EDR, or MDM solutions is a plus.
• Experience in regulated environments, particularly in the financial and tax sectors, or experience with Brazil's LGPD, is a plus.
• Experience serving as the point of contact for a SOC or outsourced MDR service is a plus.