OSOC Security Analyst - Cloud Pentesting

About the role

Evolve Security, a cybersecurity services firm based in Chicago, is looking for an OSOC Security Analyst to join its growing team. The role supports the delivery of application vulnerability assessments, continuous internal and external penetration tests, cloud security assessments, incident response and detection assessments, and security strategy and architecture reviews.

Key responsibilities

• Conduct hands-on cloud penetration testing across Azure, AWS and GCP, finding IAM misconfigurations, excessive permissions, privilege escalation paths, exposed storage buckets and service misconfigurations.
• Perform offensive enumeration and attack-path mapping using tools such as ScoutSuite, Prowler, Pacu, ROADtools/ADRecon and GCP tooling.
• Review the eASM dashboard daily for anomalies or incidents, test and validate vulnerabilities found by the ASM system, and investigate them for impact and root cause.
• Run scanning and password attacks, review security configurations, and escalate vulnerabilities and incidents to clients or internal teams.
• Meet clients at project kick-offs to understand their security needs, and help mature eASM processes, procedures, templates and methodologies.
• Take on other duties supporting enterprise and academy initiatives.

Required profile

• 0-1 years of IT experience, ideally in information security, and 0-1 years of penetration testing, application and vulnerability management experience.
• Foundational understanding of cloud security and offensive testing for Azure, AWS and/or GCP.
• Hands-on exposure to cloud-native offensive tools via labs, coursework, CTFs or professional experience.
• Security+ required; cloud security or offensive certifications (AZ-500, AWS Certified Security Specialty, GCP Professional Cloud Security Engineer) are a strong plus.
• Ability to interface with clients and strong communication skills.

Required skills

• Knowledge of multiple operating systems and command-line tools (Bash / PowerShell)
• Familiarity with the web application stack
• Cloud-native pentesting tools (ScoutSuite, Prowler, Pacu, ROADtools, ADRecon) are a plus
• Scripting in Ruby, Python, Perl, Bash or ESCP is a plus

What we offer

• Salary of $50,000 per year
• Healthcare benefits and 401(k) match
• Parental leave and flexible paid time off
• Annual vacation reimbursement