Blackpoint Cyber - Cloud MDR Analyst SkillBridge Intern (Hybrid Shift M-F 12 PM
Upload My Resume
Drop here or click to browse · Tap to choose · PDF, DOCX, DOC, RTF, TXT
Requirements
• Motivation and drive to work in a fast-paced and dynamic external SOC environment with a focus on cloud and SaaS security • Minimum of 1-2 years of experience in an information security role; progressive relevant training and/or certification may be substituted for one year of the experience requirement • Experience working in a SOC with cloud incident exposure preferred • Working knowledge of Microsoft 365 security features including Microsoft Defender for Office 365, Microsoft Defender for Identity, Microsoft Entra ID (Azure AD), Conditional Access Policies, and the Microsoft Unified Audit Log • Familiarity with Google Workspace security capabilities including Google Workspace Admin Console, Context-Aware Access, DLP policies, and Google Workspace Audit & Investigation Tool • Understanding of cloud identity attack vectors such as credential stuffing, MFA bypass techniques (AiTM, SIM-swapping), OAuth phishing, and token theft • Some knowledge of cloud-adjacent tradecraft including Living off the Land techniques applied to cloud environments, lateral movement via federated identity, and cloud persistence mechanisms • Excellent problem-solving skills, critical thinking, and analytical skills with the ability to deconstruct issues and hunt anomalous patterns in cloud telemetry • Excellent verbal and written communication skills to effectively summarize and present cloud incident findings to both technical and non-technical stakeholders • Ability to work independently or as a member of a team in a shift-based environment • Experience with CTF platforms or cloud security labs such as TryHackMe, PwnedLabs, or Microsoft Learn security paths are a plus • What We Can Do For You • Exposure to nation-state grade MDR with hands-on response capability across Microsoft 365 and Google Workspace — the cloud platforms most targeted by modern adversaries • Intensive training program designed by SOC leadership, including cloud-specific onboarding tracks covering M365 Defender, Entra ID, and Google Workspace forensics to ensure you are set up for success • Empowering you to upskill in areas like Cloud Threat Hunting, Identity & Access Abuse detection, and SaaS Security Posture Management (SSPM) — we love seeing analysts automate cloud log enrichment or contribute to the team's detection knowledge base • Growth opportunities within a rapidly expanding Cloud Response capability that is only going to get bigger and smarter as adversaries continue to shift their focus to cloud and SaaS environments • Blackpoint Cyber welcomes and encourages applications from qualified individuals of all races, colors, religions, sex, sexual orientation, gender identity or expression, national origin, age, marital status, or any other legally protected status. We are committed to equality of opportunity in all aspects of employment. For eligible employees in the US, Blackpoint offers competitive Health, Vision, Dental, and Life Insurance plans, a robust 401k plan, Discretionary Time Off, and other minor perks.
Responsibilities
• Blackpoint Cyber is seeking a Cloud MDR Analyst with demonstrated experience in Security Operations and Cloud Security to join our Threat Operations Center. In this role, you will be a frontline defender of our clients' cloud environments — monitoring, investigating, and responding to threats targeting Microsoft 365, Google Workspace and Cisco Duo as part of our Cloud Response capability. You will work alongside seasoned MDR analysts in a 24×7×365 environment to detect and neutralize adversaries operating within SaaS and cloud-native attack surfaces before they can cause harm. • How You'll Make an Impact • Monitor and analyze anomalous behavior across Microsoft 365, Google Workspace and Cisco Duo environments, including suspicious sign-ins, OAuth application abuse, mailbox rule manipulation, data exfiltration indicators, and identity-based attacks • Follow standardized Cloud Response playbooks to triage, escalate, and respond to security events across SaaS platforms, including account containment, session revocation, and admin remediation actions • Investigate cloud-specific attack techniques such as Business Email Compromise (BEC), adversary-in-the-middle (AiTM) phishing, OAuth consent grant abuse, and privilege escalation via misconfigured cloud permissions • Collaborate with Senior Analysts to research and investigate emerging cloud threat tradecraft and contribute recommendations for new detection logic targeting M365 and Google Workspace telemetry • Proactively identify and mitigate false positives across cloud alert pipelines by working with senior analysts to suppress noisy or low-fidelity detections • Collaborate with customers to review cloud security incidents and assist with detection, prevention, and mitigation strategies — including guiding clients through Microsoft Secure Score improvements and Google Workspace security posture reviews • Leverage cloud-native audit logs — including Microsoft Unified Audit Log, Azure AD Sign-in Logs, and Google Workspace Admin Reports — to reconstruct attacker timelines and scope incidents • Bring your observant and curious mindset to cloud investigations and security events!
Benefits
• Workers in this program will continue to receive their Military Pay and Benefits for the duration of the Internship. $1 • TO BE ELIGIBLE FOR DOD SKILLBRIDGE JOB OPPORTUNITES, YOU MUST BE AN ACTIVE MEMBER OF THE U.S. MILITARY WITH 180 DAYS OF SERVICE OR FEWER REMAINING PRIOR TO YOUR DATE OF SEPARATION AND HAVE AT LEAST 180 CONTINUOUS DAYS OF ACTIVE SERVICE • Upload your resume here to autofill key application fields. • Drop your resume here! • Parsing your resume. Autofilling key fields... • or drag and drop here • Another Gender Identity • I prefer not to answer • Asian or Asian American • Black or African American • Hispanic or Latine • Indigenous or Native American • Native Hawaiian or Other Pacific Islander • Person with disability • Refugee or immigrant • None of the above • Decline to self-identify • Hispanic or Latino - A person of Cuban, Mexican, Puerto Rican, South or Central American, or other Spanish culture or origin regardless of race. • Hispanic or Latino • White (Not Hispanic or Latino) - A person having origins in any of the original peoples of Europe, the Middle East, or North Africa. • White • Black or African American (Not Hispanic or Latino) - A person having origins in any of the black racial groups of Africa. • Native Hawaiian or Other Pacific Islander (Not Hispanic or Latino) - A person having origins in any of the peoples of Hawaii, Guam, Samoa, or other Pacific Islands. • Asian (Not Hispanic or Latino) - A person having origins in any of the original peoples of the Far East, Southeast Asia, or the Indian Subcontinent, including, for example, Cambodia, China, India, Japan, Korea, Malaysia, Pakistan, the Philippine Islands, Thailand, and Vietnam. • Asian • American Indian or Alaska Native (Not Hispanic or Latino) - A person having origins in any of the original peoples of North and South America (including Central America), and who maintain tribal affiliation or community attachment. • American Indian or Alaska Native • Two or More Races (Not Hispanic or Latino) - All persons who identify with more than one of the above five races. • Two or More Races • Hispanic or Latino • White (Not Hispanic or Latino) • Black or African American (Not Hispanic or Latino) • Native Hawaiian or Other Pacific Islander (Not Hispanic or Latino) • Asian (Not Hispanic or Latino) • American Indian or Alaska Native (Not Hispanic or Latino) • Two or More Races (Not Hispanic or Latino) • I identify as one or more of the classifications of protected veteran listed above • I am not a protected veteran
No credit card. Takes 10 seconds.