Cloud Security Analyst Job Description

A Cloud Security Analyst watches an organization's cloud accounts for signs of attack and misconfiguration, works out what happened when an alert fires, and turns the answer into a fix someone can ship. The job sits inside a security operations team or a cloud security group, and the raw material is telemetry: AWS CloudTrail and VPC Flow Logs, Azure Activity Logs and Microsoft Entra sign-in logs, Google Cloud Audit Logs, plus the findings that native detection services raise on top of them.

The title is a specialization of a broader federal occupation. O*NET's job-title file does not list "cloud security analyst" by name, but it files neighboring titles such as Cloud Security Engineer and Cloud Security Architect under Information Security Analysts, the occupation BLS uses for pay and employment data.

Alert triage and investigation

A typical shift starts with a queue. Amazon GuardDuty, Microsoft Defender for Cloud and Google Security Command Center each surface findings: an IAM access key used from an unfamiliar autonomous system, a storage bucket made public, a container pulling an image from an untrusted registry. The analyst decides which findings are real, then pulls the surrounding log history to reconstruct the sequence. Which principal made the call, what role it assumed, which resources it touched, and whether the session reached data or other accounts. Queries run in whatever the SIEM speaks: KQL in Microsoft Sentinel, SPL in Splunk, YARA-L in Google Security Operations, or SQL against logs stored in a data lake.

Posture and configuration drift

Not every problem is an intruder. Much of the work is spotting settings that drifted from a baseline: a security group opened to the internet for a test and never closed, logging disabled in a new account, a service account granted owner rights. Analysts read cloud security posture management findings, rank them by exposure, and open tickets with the platform or application team that owns the resource. Good analysts write those tickets with the exact resource ID, the risk in plain language and a suggested remediation, so an engineer can act without a meeting.

Logging coverage

An investigation is only as good as the logs that exist. Analysts check that audit trails are turned on, routed to the SIEM and retained. In Microsoft 365, CISA's May 2026 logging playbook notes that SearchQueryInitiated logging must be enabled for both Exchange and SharePoint because it is disabled by default. That kind of gap is invisible until someone needs the record.

Incident response and reporting

When an alert proves real, the analyst helps contain it: revoking credentials, isolating a workload, snapshotting a disk for forensics. They write the timeline, map the activity to MITRE ATT&CK techniques, and feed lessons back into detection rules. Analysts also gather evidence for audits against SOC 2, PCI DSS, HIPAA or federal frameworks, which turns daily monitoring into documented proof that controls run.

Education

BLS lists a bachelor's degree as the typical entry-level education for information security analysts, along with work experience in a related occupation. Computer science, information systems and cybersecurity degrees are the common routes. Candidates without a degree can still compete if they can show hands-on work: a home lab with cloud trails feeding a SIEM, detection rules in a public repository, or write-ups of capture-the-flag cloud challenges.

Experience

As a rough guide, people reach a cloud security analyst title after two to four years in a security operations center, a cloud or systems administration job, or a help desk role that grew into identity and access work. The useful background is having investigated something real: an analyst who has traced a phishing compromise through mailbox audit logs understands how to trace an abused cloud role through CloudTrail.

Certifications

Credentials worth pursuing, each named with the body that awards it:

• Microsoft Certified: Security Operations Analyst Associate (Exam SC-200) (Microsoft): Microsoft's audience profile describes a candidate who reduces organizational risk by performing triage, responding to incidents, hunting for threats and engineering detections. Microsoft updated the skills measured as of October 21, 2026, so check the current study guide before preparing.
• AWS Certified Security - Specialty (Amazon Web Services): for analysts in AWS-heavy environments.
• CompTIA Security+ and CompTIA Cybersecurity Analyst+ (CySA+) (CompTIA): vendor-neutral foundations in security operations and detection.
• GIAC Cloud Threat Detection (GCTD) (GIAC): focused on identifying threats to cloud environments and responding to them.
• Certificate of Cloud Security Knowledge (CCSK) (Cloud Security Alliance): vendor-neutral cloud security concepts.
• Certified Cloud Security Professional (CCSP) (ISC2): ISC2 lists five years of required work experience, so it suits people moving toward architecture or program ownership.

Technical skills

• Log sources: CloudTrail, VPC Flow Logs, Azure Activity Log, Entra ID sign-in and audit logs, Google Cloud Audit Logs, Microsoft Purview audit records
• Detection services: GuardDuty, Defender for Cloud, Security Command Center, AWS Security Hub
• Query languages: KQL, SPL, YARA-L, SQL for Athena or BigQuery
• Identity: IAM policy evaluation, role trust policies, Entra conditional access, service account keys
• Frameworks: MITRE ATT&CK cloud matrix, CIS Benchmarks for AWS, Azure and Google Cloud
• Scripting: Python and the cloud CLIs for enrichment and quick containment actions

Working style

The job rewards people who write clearly. Every investigation ends in a ticket, a timeline or an audit artifact that someone else will read without the analyst in the room. Comfort with on-call rotations helps too, since cloud alerts do not keep office hours.

BLS does not count Cloud Security Analysts separately. Its figures for the closest occupation, information security analysts, show 192,900 jobs in 2025 and projected growth of 21 percent from 2025 to 2035, which BLS rates much faster than the average for all occupations. Those numbers describe the whole occupation, not cloud specialists alone.

Pay by employer type

The May 2025 national median for information security analysts was $129,180. Industry rows show how much the setting matters. In management of companies and enterprises, the median was $128,950. In federal, state and local government (excluding public schools, hospitals and the Postal Service), it was $101,760. BLS does not report pay for the cloud security analyst title on its own.

Federal rules that create cloud monitoring work

Two federal programs set out specific cloud monitoring work.

CISA Binding Operational Directive 25-01. Issued December 17, 2024, BOD 25-01 requires federal civilian executive branch agencies to identify their in-scope cloud tenants, deploy CISA's Secure Cloud Business Applications (SCuBA) assessment tools, and report results through CISA's continuous monitoring infrastructure or manually each quarter. Agencies must implement the mandatory policies in CISA's Secure Configuration Baselines and begin continuous monitoring for new cloud tenants before granting an Authorization to Operate. CISA published final baselines for Microsoft Office 365 at issuance and has since published final baselines for Google Workspace, according to its implementation guidance updated July 27, 2026. Running those scans, explaining deviations in the tool output and tracking remediation is security analyst work.

FedRAMP 20x. For cloud service providers selling to the government, FedRAMP's 2026 consolidated rules describe Key Security Indicators that ask providers to demonstrate security capabilities rather than check off requirements. FedRAMP says the processes behind them should continuously collect evidence, detect configuration drift and alert on deviations from security baselines. Each of those is a monitoring task.

How AI is changing the queue

Google and Microsoft now ship AI agents aimed at the triage step. Google's Triage and Investigation Agent in Google Security Operations determines whether alerts are true or false positives and summarizes its reasoning; by default it starts five minutes after an alert is generated so late-arriving events can be correlated. Microsoft's Security Alert Triage Agent in Defender has extended from email alerts to cloud and identity alerts, with the cloud and identity coverage in preview. Both vendors frame the output as a verdict with an explanation, which leaves the analyst to check the reasoning, handle the cases the agent cannot close, and tune detections.

Where the role leads

Common next steps include senior analyst, detection engineer, incident responder, cloud security engineer and, with time, security architecture or management.

Dear Hiring Manager,

I am applying for the Cloud Security Analyst position on your security operations team. For the past three years I have worked as a SOC analyst at a regional logistics company, where I moved from email and endpoint alerts to owning our AWS and Microsoft 365 detection queue after the company migrated its warehouse systems to the cloud.

The work I am proudest of started with a single GuardDuty finding: an access key calling the S3 API from a hosting provider we had never used. I traced the key through CloudTrail to a CI pipeline that had printed it into a build log, confirmed which buckets the role could read, rotated the credential within the hour and wrote the timeline for our incident review. Afterward I built a Sentinel analytics rule that flags any long-lived access key used from a new autonomous system, and I worked with the platform team to move that pipeline to short-lived role credentials.

I also run our weekly posture review. I sort the findings by internet exposure and data sensitivity, open tickets with the owning teams, and write each one so an engineer can fix it without a call. Our open high-severity backlog is now a list people actually close.

I hold the Microsoft SC-200 and CompTIA CySA+ certifications and am studying for the AWS Certified Security - Specialty exam. I write KQL and SPL daily and use Python to enrich alerts with asset and owner data.

I would welcome the chance to bring that mix of investigation and follow-through to your team. Thank you for your time and consideration.

Sincerely, Jordan Alvarez