Senior Cloud Info Security Analyst

USAA•San Antonio, NC

12h•Hybrid

About The Position

The Senior Cloud Info Security Analyst joins USAA’s Cloud Incident Response team within the Cyber Threat Operations Center (CTOC), helping protect the organization from evolving cyber threats. The role investigates and responds to security incidents across AWS, Azure, Google Cloud, and SaaS platforms, using advanced security technologies in a large-scale cloud environment. The analyst collaborates with engineers, threat hunters, and security leaders to strengthen detection capabilities, improve response processes, and secure critical business services. The position leads information security activities, researches threats and vulnerabilities, monitors systems for advanced security events, and performs detailed incident analysis to identify root cause, impact, and attacker tactics. It also develops and trains analysts, improves detection capabilities and security controls based on incident findings, and briefs senior leadership on threats, incidents, and recommendations. The role helps ensure business risks are identified, measured, monitored, and controlled in line with risk and compliance policies. This is a flexible work environment requiring four days per week in the office. The position may be based in San Antonio, Texas; Plano, Texas; Phoenix, Arizona; Charlotte, North Carolina; or Colorado Springs, Colorado. Relocation assistance is not available. USAA does not provide visa sponsorship for this role.

Requirements

Bachelor’s degree, or four years of relevant education and/or experience.
Six years of related experience in Information Security, Cybersecurity, and/or Information Technology with a security focus, including accountability for complex tasks and/or projects.
Four years of related experience in at least one of these domains: Security and Risk Management, Asset Security, Security Architecture and Engineering, Communications and Network Security, Identity and Access Management, Security Assessment and Testing, Security Operations, or Software Development Security.
Advanced business acumen in business operations, risk management, industry practices, and emerging trends.
Knowledge of attacker tools, tactics, and procedures and how to apply them to access management, governance, threat hunting, investigations, and incident response.
Knowledge of defense-in-depth principles and security architecture.

Nice To Haves

Experience investigating complex security incidents across AWS, Azure, GCP, and SaaS.
Strong knowledge of IAM, cloud networking, APIs, logging, and cloud-native services.
Ability to independently scope incidents, analyze evidence, determine root cause, and drive remediation.
Experience with SIEM, EDR, and cloud security tools such as CrowdStrike, Sentinel, Splunk, Elastic, Wiz, or Prisma Cloud.
Strong understanding of cloud threats, including credential compromise, privilege escalation, API abuse, lateral movement, and data exfiltration.
Experience with cloud forensics, detection engineering, automation, and incident response playbooks.
Ability to lead investigations and communicate findings to technical teams and leadership.
Strong knowledge of MITRE ATT&CK and incident response frameworks.
Relevant certifications such as GCIH, GCFA, CCSP, CISSP, or cloud security certifications.

Responsibilities

Lead peers and team members in executing Information Security domain activities, anticipating efforts that will affect the team.
Research and analyze information security vulnerabilities, threats, exploits, trends, and intelligence, and share intelligence with peer teams.
Conduct advanced vulnerability management, security configuration assessments, and/or penetration testing operations, and manage resulting findings.
Develop analysts through training and knowledge-sharing activities.
Monitor internal and external networks, systems, and applications for advanced security anomalies and events.
Respond to cyber incidents and perform detailed analysis using security tools and experience in areas such as forensics, networking, servers, and coding to determine root cause, impact, and malicious actors’ tactics, techniques, and procedures.
Train analysts in incident detection and response.
Use findings from incident response to make significant or complex improvements to detection capabilities, operational processes, and security controls.
Prepare and deliver written and/or verbal briefings with recommendations to senior leadership on threats, alerts, incidents, and improvements.
Provide insight on issues and mentor and coach peers and team members in the assigned area of responsibility.
Ensure risks associated with business activities are identified, measured, monitored, and controlled in accordance with risk and compliance policies and procedures.

Benefits

Comprehensive medical plans
Dental plans
Vision plans
401(k)
Pension
Life insurance
Parental benefits
Adoption assistance
Paid time off
Paid holidays
16 paid volunteer hours
Wellness programs
Career path planning
Continuing education assistance
Employees may be eligible for pay incentives based on corporate and individual performance and at the discretion of the USAA Board of Directors.