DESCRIPTION

We are open to hiring candidates to work out of one of the following locations:

Seattle, WA, USA

At Amazon, we are laser-focused on earning and maintaining customer trust. The Corporate Services Security team (CPSS) protects critical business services that our employees use to deliver the best products and services on planet earth.

Our Large-Scale Risk Reduction team (LSR) is looking for an innovative and impact-driven senior security engineer who has a strong passion for security at scale. This team is responsible for identifying large-scale risk within corporate services and integrations across the corporate services space, both first-party and third-party. This team secures the business by identifying and uncovering systemic risk, prioritizing scalable solutions, and driving mitigation efforts that lead to lasting and large-scale change across the company.

A senior security engineer in this role will operate across multiple Amazon Security teams and will leverage their diverse and deep expertise to drive strategic risk reduction with business leaders at the highest levels. They will identify opportunities to effectively scale our portfolio in order to meet the diverse needs of our customers. They will bring unique and creative insight into how we identify and drive risk reduction across the business. They work smarter and connect experts across disciplines to develop solutions that would otherwise not be feasible.

A person in this role must show exemplary judgment in making trade-offs between short-term fixes and long-term security and business goals. They think big and deliver impact. They must also demonstrate resilience and navigate ambiguous situations with composure and tact. Above all else, earning and maintaining trust along with a strong sense of customer obsession is necessary to achieve the ultimate goal of keeping Amazon and its customers secure.

Key job responsibilities
– Develop and deliver hunting campaigns to discover systemic risk plaguing the organization
– Write compelling narratives for stakeholders to consume and understand risk and impact
– Write crisp executive summaries for presentation to stakeholders and executives
– Develop innovative accelerators, tools, and mechanisms to improve the team’s velocity and quality
– Facilitate forums with principal engineers to drive consensus on appropriate solutions
– Demonstrate creativity, insight, intellectual flexibility, and sound risk judgment
– Work independently, but collaborate with cross-functional teams to produce broad impact and exceptional results
– Be a multiplier and operate with humility while being right, a lot

A day in the life
The Corporate Services Security (CPSS) Large-Scale Risk Reduction (LSR) team is responsible for performing deep analysis, identifying systemic risk, proposing scalable solutions, driving mitigation campaigns, and establishing secure third-party vendor data sharing relationships. The team works to identify, track, monitor, mitigate, and report on large-scale security risk reduction efforts. Through adoption of security controls that scale, and the assessment of internal services and third-party vendors, we are able to ensure Amazon’s high security bar is exceeded.

The CPSS Large-Scale Risk Reduction team mission is to provide assurance by identifying and reducing risk through proactive assessment, monitoring, and mitigation.

About the team
Diverse Experiences
Amazon Security values diverse experiences. Even if you do not meet all of the qualifications and skills listed in the job description, we encourage candidates to apply. If your career is just starting, hasn’t followed a traditional path, or includes alternative experiences, don’t let it stop you from applying.
Why Amazon Security?
At Amazon, security is central to maintaining customer trust and delivering delightful customer experiences. Our organization is responsible for creating and maintaining a high bar for security across all of Amazon’s products and services. We offer talented security professionals the chance to accelerate their careers with opportunities to build experience in a wide variety of areas including cloud, devices, retail, entertainment, healthcare, operations, and physical stores.
Inclusive Team Culture
In Amazon Security, it’s in our nature to learn and be curious. Ongoing DEI events and learning experiences inspire us to continue learning and to embrace our uniqueness. Addressing the toughest security challenges requires that we seek out and celebrate a diversity of ideas, perspectives, and voices.
Training & Career Growth
We’re continuously raising our performance bar as we strive to become Earth’s Best Employer. That’s why you’ll find endless knowledge-sharing, training, and other career-advancing resources here to help you develop into a better-rounded professional.
Work/Life Balance
We value work-life harmony. Achieving success at work should never come at the expense of sacrifices at home, which is why flexible work hours and arrangements are part of our culture. When we feel supported in the workplace and at home, there’s nothing we can’t achieve.

BASIC QUALIFICATIONS

– 6+ years of experience in two or more of the following security domains categories: Pentesting, Red Teaming, Security Architecture, Data Analytics, SDLC, or Application Security
– 6+ years of experience running offensive security or deep dive campaigns in large, complex organizations
– 5+ years of experience performing penetration testing
– 3+ years of experience with AWS technologies and services
– Demonstrated proficiency with Python, C/C++, Lua, Golang, or Rust. Ability to prepare technical specifications and executive-ready communications

PREFERRED QUALIFICATIONS

– Experience as a software or devops engineer, or security engineer, working with developer teams that delivered commercial software or services
– Threat modeling experience and knowledge of AWS Cloud Security principles
– Threat hunting and/or detection engineering and experience in automation and orchestration (Chef, Puppet, Ansible, etc)
– GIAC Defensible Security Architecture (GDSA), OSCP, OSCE3, OSWE, or similar
– Published CVEs, offensive tools, or articles

Amazon is committed to a diverse and inclusive workplace. Amazon is an equal opportunity employer and does not discriminate on the basis of race, national origin, gender, gender identity, sexual orientation, protected veteran status, disability, age, or other legally protected status. For individuals with disabilities who would like to request an accommodation, please visit https://www.amazon.jobs/en/disability/us.

Our compensation reflects the cost of labor across several US geographic markets. The base pay for this position ranges from $143,300/year in our lowest geographic market up to $247,600/year in our highest geographic market. Pay is based on a number of factors including market location and may vary depending on job-related knowledge, skills, and experience. Amazon is a total compensation company. Dependent on the position offered, equity, sign-on payments, and other forms of compensation may be provided as part of a total compensation package, in addition to a full range of medical, financial, and/or other benefits. For more information, please visit https://www.aboutamazon.com/workplace/employee-benefits. This position will remain posted until filled. Applicants should apply via our internal or external career site.

USA, WA, Seattle