The AWS Security Analyst L2 is responsible for monitoring, investigating, and responding to security threats across AWS cloud environments. The role focuses on operational security, incident analysis, Guard Duty monitoring, Security Hub findings management, WAF administration, DDoS protection, and cloud security compliance.
Key Responsibilities
Security Monitoring & Incident Response
- Monitor AWS Security Hub, Guard Duty, Cloud Trail, and Cloud Watch alerts.
- Investigate security incidents and suspicious activities.
- Analyze Indicators of Compromise (IOC) and Indicators of Attack (IOA).
- Perform incident triage and escalation.
- Support containment and remediation activities.
AWS Security Operations
- Manage and review Security Hub findings.
- Investigate Guard Duty threat detections.
- Monitor Cloud Trail logs for anomalous activities.
- Validate security events and eliminate false positives.
- Support vulnerability remediation activities.
Web Application Security
- Administer AWS WAF policies and rule sets.
- Manage IP reputation and geo-blocking rules.
- Create custom WAF rules for application protection.
- Analyze application-layer attack patterns.
DDoS Protection
- Monitor AWS Shield Standard and Shield Advanced.
- Investigate DDoS attack alerts and traffic anomalies.
- Coordinate mitigation efforts with infrastructure teams.
- Support incident reporting and post-incident analysis.
Compliance & Governance
- Support CIS AWS Benchmark compliance.
- Assist in cloud security audits.
- Review security posture and compliance findings.
- Support regulatory requirements such as ISO27001, SOC2, GDPR.