Amazon

DESCRIPTION

Are you inspired by the prospect of work that has a tangible impact on customers, teams, and businesses worldwide? Is your expertise in dissecting complex systems, ranging from embedded software to cloud services, matched by a zeal for uncovering product vulnerabilities? If the thrill of automating vulnerability detection and scaling its reach excites you then we have the perfect opportunity for you. Amazon’s Security team is on the hunt for a Sr. Security Engineer. This pivotal role is designed for those who are fervent about engineering scalable security solutions with significant impact.

In this position, you will pioneer technologies and frameworks that cater to the unique security demands of various builder teams at Amazon. As an integral member of a committed team of security experts, you will engage in vulnerability research and analysis, and craft automation strategies to pinpoint vulnerabilities. Your mission will involve developing sophisticated security testing capabilities to identify and mitigate risks throughout the Software Development Life Cycle (SDLC). Your goal is to deeply understand systems, software, and services, innovating ways to detect vulnerabilities and formulate preventive measures. Embracing automation, you will minimize manual processes, thereby elevating our internal customers’ security standards. You will collaborate with development teams to deliver solutions that simplify the creation and management of secure systems. As a leader, you will ensure that Amazon’s products consistently earn customer trust. You will spearhead the exploration of industry leading solutions to complex challenges. Your influential voice will guide the strategic direction of automated security tools within Amazon.

Key job responsibilities

• Scaling vulnerability detection by inventing, developing and improving custom high quality automated detection tools (e.g. static analyzers, fuzzers, scanners, etc.) to perform variety of security vulnerability (SAST, DAST etc.) analysis.
• Providing actionable long-term risk mitigation guidance as well as engineering auto-remediation capabilities to drive security improvements at scale.
• Making strategic decisions on new security detection solutions which should be pursued for scaling security in builder organizations.
• Proposing mechanisms for integrating security detection tools into the development life-cycle.
• Inventing advanced security detection tools which developers can use to self-discover and avoid security vulnerabilities and misconfigurations.
• Advising managers, directors, and peers on automated security detection matters and influence development teams to adopt detection capabilities.
• Independently tackling large cross-cutting security issues affecting multiple builder orgs. Prioritize and develop security issue detection, collaborating with partner orgs to address unique requirements.

A day in the life

The role of a Sr. Security Engineer on the Detection Engineering team is to ensure that Amazon’s products are developed securely in order to maintain our customers’ trust. They work on developing automated detection capabilities in all stages of the SDLC which help developers discover and address security mistakes. Detection Engineers develop independent, continuous and automated security verification detection capabilities for their customers (partners and builder teams). They collaborate with subject matter experts across SBS Sec, Stores Sec, AWS Sec, and the development organizations they support to evolve and scale automated detection capabilities. They work on and contributing to the established AmSec security detection ecosystem which orchestrates the execution and converges the output of automated detection tools. They also allow for easy access to information regarding comprehensive security health metrics for orgs/applications and on-demand intelligence reporting. And finally, they drive remediation to reduce the overall risk to the businesses they support and ultimately protect Amazon’s customers.

BASIC QUALIFICATIONS

• CCSP (Certified Cloud Security Professional) or CEH (Certified Ethical Hacker) or CFR (CyberSec First Responder) or Cloud+ or CySA+ (CompTIA Cybersecurity Analyst) or GCED (GIAC Certified Enterprise Defender) or GICSP (Global Industrial Cyber Security Professional) or PenTest+
• Knowledge and understanding of security engineering, system and network security, authentication and security protocols, cryptography, and devices and application security.
• Experience as a mentor, technical lead, or leading an engineering team.
• Proven experience in threat modeling, code reviews, security testing, vulnerability detection, attacker exploit techniques, and methods for their remediation.

PREFERRED QUALIFICATIONS

• Knowledge of common software security vulnerabilities (memory corruption, privilege escalation, web application exploitation, protocol-based weaknesses, etc.) and experience with various methods to successfully exploit them.
• Experience in penetration testing, developing proof-of-concept exploits and knowledge of remediation techniques.
• Working experience with vulnerability detection tools such as static and dynamic analyzers, fuzzers, etc.
• Experience with Amazon technologies (S3, EC2, Lambda, etc.)
• Experience with scripting (bash, Perl, Python etc.)
• Experience with at least one major programming language (Java, C#, etc.)

Amazon is committed to a diverse and inclusive workplace. Amazon is an equal opportunity employer and does not discriminate on the basis of race, national origin, gender, gender identity, sexual orientation, protected veteran status, disability, age, or other legally protected status.

Los Angeles County applicants: Job duties for this position include: work safely and cooperatively with other employees, supervisors, and staff; adhere to standards of excellence despite stressful conditions; communicate effectively and respectfully with employees, supervisors, and staff to ensure exceptional customer service; and follow all federal, state, and local laws and Company policies. Criminal history may have a direct, adverse, and negative relationship with some of the material job duties of this position. These include the duties and responsibilities listed above, as well as the abilities to adhere to company policies, exercise sound judgment, effectively manage stress and work safely and respectfully with others, exhibit trustworthiness and professionalism, and safeguard business operations and the Company’s reputation. Pursuant to the Los Angeles County Fair Chance Ordinance, we will consider for employment qualified applicants with arrest and conviction records.

Pursuant to the San Francisco Fair Chance Ordinance, we will consider for employment qualified applicants with arrest and conviction records.

Our inclusive culture empowers Amazonians to deliver the best results for our customers. If you have a disability and need a workplace accommodation or adjustment during the application and hiring process, including support for the interview or onboarding process, please visit https://amazon.jobs/content/en/how-we-hire/accommodations for more information. If the country/region you’re applying in isn’t listed, please contact your Recruiting Partner.

Our compensation reflects the cost of labor across several US geographic markets. The base pay for this position ranges from $143,300/year in our lowest geographic market up to $247,600/year in our highest geographic market. Pay is based on a number of factors including market location and may vary depending on job-related knowledge, skills, and experience. Amazon is a total compensation company. Dependent on the position offered, equity, sign-on payments, and other forms of compensation may be provided as part of a total compensation package, in addition to a full range of medical, financial, and/or other benefits. For more information, please visit https://www.aboutamazon.com/workplace/employee-benefits. This position will remain posted until filled. Applicants should apply via our internal or external career site.