Cloud Security Analyst

BI Worldwide•Edina, MN

23h•Hybrid

About The Position

The Information Security & Compliance team is seeking a technically curious, detail-oriented security professional to configure, monitor, and protect the company’s cloud SaaS platforms, including Salesforce, ServiceNow, Microsoft 365, and other applications. The role owns data security settings, builds and tunes monitoring and event detection, and leads threat discovery and remediation across some SaaS environments while partnering with platform owners across others. The scope is broad and may expand to additional platforms over time; the successful candidate is expected to learn unfamiliar platforms and become increasingly self-sufficient as they gain knowledge of the applications and environment. The primary focus is hands-on security configuration, monitoring, and threat response for cloud SaaS environments. The analyst is expected to independently resolve routine and moderately complex issues, investigate meaningfully before escalating, and steadily expand the set of platforms they can secure. Deeper security architecture, infrastructure, and application engineering remain collaborative work with relevant subject-matter experts and platform owners. The role provides first-line security ownership of the SaaS footprint so senior resources can be engaged when their expertise is needed. This position follows a hybrid model, with three days in the office and two days working from home, and is located at the company’s Minneapolis Metro headquarters.

Requirements

Experience in information security, security operations, cloud security, identity and access management, systems administration, or a related technical discipline.
Hands-on experience administering or securing at least one major SaaS platform, such as Salesforce, ServiceNow, or Microsoft 365.
Understanding of least privilege, identity federation (SAML, OAuth, OIDC), MFA, encryption, data classification, and logging.
Ability to read and interpret audit logs, sign-in events, security alerts, and technical documentation.
Strong troubleshooting and analytical problem-solving skills, including methodical work on unfamiliar security problems.
Familiarity with scripting or query languages such as PowerShell, Python, KQL, or SOQL, and ability to automate repeatable security tasks.
Experience triaging security alerts and investigating suspicious activity through to resolution.
Ability to distinguish routine security events from incidents that require escalation or broader response.
Ownership mindset: investigate before escalating, document findings, and seek ways to prevent recurring issues.
Ability to identify practical opportunities to improve security posture through automation, detections, tooling, documentation, or processes.
Ability to balance risk reduction with business usability without over-engineering solutions.
Interest in improving supportability and reducing dependence on tribal knowledge or a single subject-matter expert.
Ability to explain security risks and recommendations clearly to technical and non-technical audiences.
Ability to document security standards, procedures, and investigation steps so others can follow them.
Comfort collaborating across IT, application administration, infrastructure, compliance, legal, and business teams.

Nice To Haves

Experience with Microsoft security technologies such as Entra ID, Defender for Cloud Apps, Defender XDR, Purview (DLP, sensitivity labels, Insider Risk), or Sentinel.
Experience with Salesforce Shield (Event Monitoring, Platform Encryption, Field Audit Trail) or Salesforce security configuration.
ServiceNow security administration experience, including ACLs and instance hardening.
Experience with SSPM or CASB tools.
Experience with SIEM or SOAR platforms, log ingestion, or detection engineering.
Experience with identity platforms such as Okta or Entra ID, including SSO and lifecycle management.
Familiarity with NIST CSF, CIS Benchmarks, MITRE ATT&CK, SOC 2, or ISO 27001.
Security certifications such as Security+, CySA+, CCSP, Microsoft SC-200, SC-300, or SC-401, or Salesforce Security and Administrator credentials.

Responsibilities

Own data security across assigned cloud SaaS platforms and partner with platform owners to apply security best practices across the corporate platform environment.
Configure, harden, and maintain data security settings across cloud SaaS platforms and other business applications.
Manage and review identity and access controls, including SSO, MFA, conditional access, role and permission models, sharing settings, and privileged accounts.
Implement and maintain data protection controls such as DLP, sensitivity labels, encryption settings, field-level security, and external sharing policies.
Build, tune, and maintain SaaS monitoring, logging, and event detection, including audit log collection, alert rules, and integration with SIEM and security tools.
Triage and investigate security alerts and suspicious activity, including anomalous logins, data exfiltration, risky OAuth or third-party app connections, and unauthorized configuration changes.
Proactively hunt for threats, misconfigurations, and security posture drift using SSPM, CASB, native security consoles, and other tools.
Lead remediation of identified threats and vulnerabilities, coordinating with platform owners, administrators, and IT teams through closure.
Participate in SaaS-related incident response, including containment, evidence collection, root-cause analysis, and post-incident follow-up.
Identify repetitive manual work and create or improve scripts, automated detections, dashboards, playbooks, and workflows to reduce operational effort.
Create and maintain security baselines, configuration standards, runbooks, and procedures.
Support access reviews, audits, and compliance activities, including SOC 2, ISO 27001, and privacy requirements, for assigned SaaS platforms.
Review new SaaS applications, integrations, and significant configuration changes for security risk and advise on secure implementation.
Learn additional SaaS platforms as organizational needs and applications change.
Resolve routine and moderately complex security issues independently, conduct meaningful investigations before escalating, and expand platform security knowledge.
Collaborate with subject-matter experts and platform owners on deeper security architecture, infrastructure, and application engineering work.