Cloud Security Analyst - Kiewit Technology Group

Position Overview

The Cloud Security Analyst helps identify, assess, and reduce security risks across our cloud environments. Reporting to the team manager, this role partners with infrastructure, application development, and DevOps teams to investigate security findings, support remediation, and improve security practices throughout the cloud resource and application lifecycle.

District Overview

Kiewit Technology Group (KTG) builds solutions to enable and support a $16 billion company. Our mission is to deliver project schedule and cost certainty by employing technology designed by and for the construction industry. Our team deploys technology solutions to the field and home office departments that increase profitability by maximizing the way we use our people and resources in daily operations. KTG uses systems and tools that manage every part of Kiewit’s business and lifecycle of a project to improve planning and day-to-day execution in the field by giving our people real-time data to make faster, smarter decisions. When you join KTG, you will make an impact on the critical work we do every day.

Location

This position will be based out of our office at 12312 Port Grace Blvd, La Vista, NE 68128. This is not a remote or hybrid work opportunity. 

Responsibilities

• Cloud security posture: Review and validate findings from cloud-native application protection platforms (CNAPP) and other security tools, including misconfigurations, excessive permissions, exposed services, and insecure configurations.
• Vulnerability management: Assess vulnerabilities in cloud workloads, virtual machines, containers, and application dependencies. Prioritize findings using exploitability, exposure, business impact, and available runtime context rather than severity scores alone.
• Attack surface management: Identify internet-facing cloud assets and unintended exposures, confirm ownership, and help maintain accurate asset and assessment coverage.
• Remediation coordination: Translate findings into clear, actionable work items for infrastructure and development teams. Track progress, escalate blockers, verify fixes, and document exceptions for approval.
• Application and pipeline security: Help investigate code, dependency, secret, container image, and infrastructure-as-code findings. Support security controls in source repositories and CI/CD pipelines.
• Secure architecture: Assist with cloud design reviews covering identity, networking, data protection, logging, and workload security. Help teams apply approved patterns and least-privilege principles.
• Automation and reporting: Use scripts, APIs, and queries to improve finding enrichment, reporting, and remediation workflows. Track coverage, outstanding risk, remediation timeliness, and recurring issues.
• Threat response support: Assess whether emerging vulnerabilities or threats affect cloud resources and provide technical context to incident response teams when needed.

Required qualifications

• Foundational knowledge of cloud services and the shared responsibility model, with practical exposure to Azure, AWS, or another major cloud platform .
• Understanding of core security concepts, including least privilege, authentication and authorization, vulnerability management, encryption, and secure configuration.
• Working knowledge of networking fundamentals, including TCP/IP, DNS, firewalls, routing, and public versus private connectivity.
• Familiarity with Windows or Linux administration and the ability to investigate configuration and security findings using documentation, logs, and command-line tools.
• Basic scripting or query skills, such as PowerShell, Python, Bash, or KQL, and willingness to develop automation skills.
• Ability to distinguish a tool-generated alert from a validated risk and clearly document evidence, impact, and recommended corrective actions.
• Strong communication, organization, and follow-through; ability to collaborate with technical teams and manage assigned findings through resolution.
• Relevant experience through employment, internships, coursework, labs, military service, or personal projects.  Approximately 0–3 years of related experience; demonstrated skills matter more than a fixed tenure or degree requirement.

Preferred qualifications

• Experience with cloud security posture management, CNAPP, vulnerability scanning, or attack surface management tools.
• Familiarity with cloud IAM, service identities, secrets management, network segmentation, and cloud security logging.
• Exposure to GitHub or Azure DevOps, CI/CD pipelines, infrastructure as code, containers, or Kubernetes.
• Understanding of common application security risks and tools such as SAST, software composition analysis, and secret scanning.
• Familiarity with CIS benchmarks, OWASP guidance, or comparable security standards.
• Relevant foundational cloud or security certifications, such as Security+, AZ-900, or SC-900, or equivalent practical knowledge.