TD SYNNEX (NYSE: SNX) is the world's largest IT distributor, adopting AI at speed across Azure AI Foundry, AWS Bedrock, Copilot Studio, Databricks, and self-hosted agent environments. Our security model is runtime-first: instead of blocking AI adoption with slow approvals, we intercept, analyze, and enforce at the moment of execution — which means high-quality monitoring, triage, analytics, and reporting are what keep the system honest.
As our AI and Cloud Security Analyst, you provide day-to-day L2 coverage of the AI security detection fabric — triaging and supporting investigation of AI-specific detections from runtime defense, behavioral/intent monitoring, model-security, and adversarial-testing platforms. You turn that telemetry into insight through data analytics and produce the OCR (operational, compliance, and risk) reporting that gives leadership, control owners, and auditors a continuous picture of AI and cloud risk. You also help monitor the security posture of our Azure, AWS, and GCP environments. You escalate to a dedicated L3 engineer and work alongside two AI & Cloud Security Architects.
The analyst will report to AI & Cloud Security leadership and have strong working relationships with other Cybersecurity, IT and application development teams.
Responsibilities
- L2 coverage of the AI Security toolset . Monitor AI security detections across the detection fabric — runtime defense/AIDR events, intent and behavioral anomalies, model-level detections, and adversarial-testing signals. Validate detections, classify severity and impact, propose and implement policy updates, and escalate complex cases to L3 with complete, reusable context.
- Investigate AI-specific events across all five AI archetypes (embedded SaaS copilots, low-code/no-code agents, homegrown agentic pipelines, device-based coding agents, homegrown models): direct and indirect prompt injection, jailbreaks, sensitive-data leakage, RAG poisoning indicators, unauthorized MCP/tool activity, agent hijacking, and rogue or overprivileged agent behavior — using prompt/response logs, decision traces, identity context, and agent inventory data.
- Support the AI asset-intelligence layer : help maintain agent inventory hygiene, ownership attribution, MCP registry accuracy, and risk-scoring context that feeds runtime enforcement decisions and fast-track approval workflows.
- Data analytics . Query and correlate AI and security telemetry (KQL), identify anomalies and attack patterns, and build/maintain dashboards tracking the program's key metrics — detection volumes, runtime containment rate, mean time to detect/contain/resolve, agent-visibility coverage, approval-SLA performance, and top policy-violation categories — feeding tuning recommendations back to the L3 engineer.
- OCR reporting (operational, compliance, and risk) . Produce recurring dashboards and executive summaries communicating AI-security posture, KPIs, and trends to stakeholders and control owners; support automated NIST AI RMF compliance evidence generation and audit/regulatory reporting, including EU AI Act–related evidence for EU scope.
- Maintain rigorous case documentation and shift/handover notes; contribute observed patterns to detection-rule tuning, runbook refinement, and the closed-loop improvement cycle (red-team findings policy and detection updates re-test validation).
- Build working fluency in the OWASP Top 10 for LLM Applications 2025, the OWASP Top 10 for Agentic Applications, and MITRE ATLAS as the shared investigation taxonomy.
- Monitor and triage cloud security alerts across Azure, AWS, and GCP from company CSPM platform — misconfigurations, security risks, exposed resources, excessive permissions, workload threats — and route, remediate, or escalate per playbook.
- Support cloud compliance monitoring and reporting against CIS Benchmarks and NIST 800-53 r5 / CSF 2.0 baselines, tracking remediation to closure and integrating cloud posture into the consolidated OCR rep