Security Engineer, AWS T&C

Go beyond protecting Amazon Web Services (AWS) and have a direct impact on new cutting-edge learning initiatives at Amazon. Work across multiple security domains and tech stacks, as well as strategic security partnerships.
AWS Training and Certification (T&C), Security Engineering team, is looking for a passionate, innovative, results-oriented SaaS Security Engineer. The role requires diverse technical breadth and depth, as well as the ability to work equally well with software engineers, and business stakeholders of varying backgrounds.

Security is job zero at Amazon. In this role you will be responsible for listening to customer requirements, analyzing the security of applications and services, discovering and addressing security issues, building security automation, and decisively taking action to remediate emerging threats throughout a full secure development life-cycle (SDLC). You will be expect to validate baseline security controls to help the customers meet their security requirements, and identifying solutions or best practice documentation to help AWS builder teams move forward. In a given week you will find yourself diving deep into internal and external technologies, coordinating with vendors and internal builder teams, suggest solutions where gaps are present, build and maintain runbooks, architectural diagrams, and threat models, and implement automated security tooling, monitoring, and alerting solutions to wrap around integrated first-party, or third-party SaaS products. The ideal candidate is sensitive to customer needs, enjoys tackling ambiguous and complex problems, and thrives in a fast-paced environment. You will also need to be exposed to AWS Services and building secure solutions, or have a strong grasp in other cloud services and able to level up on AWS quickly.

Security Engineers at Amazon are expected to develop elegant solutions to complex security risk problems, and apply appropriate technologies while following security engineering best practices. You will need to draw upon technical architecture understanding, application security comprehension, critical thinking, and problem-solving, to help our internal customers deliver large-scale learning solutions, including Learning Management Systems, virtual hands-on lab architecture, Customer Relationship Management solutions, Customer Portals, and Content Management solutions. This role is part of a team, but needs to be self-directed and open to new challenges, adept at prioritization, and innovation.

Work/Life Balance
Our team puts a high value on work-life balance. It isn’t about how many hours you spend at home or at work; it’s about the flow you establish that brings energy to both parts of your life. We believe striking the right balance between your personal and professional life is critical to life-long happiness and fulfilment. We offer flexibility in working hours and encourage you to find your own balance between your work and personal lives.


Key job responsibilities
- Identify vulnerabilities in connected services and SaaS application desig

- Secure architecture design

- Threat modeling

- Security training and outreach to internal development teams

- Security guidance documentation
- Identify, research, and solve auditing and monitoring solutions for disparate first-party or third-party solutions

- Assist in vulnerability assessment, analysis, and incident response

- Interpret the completeness of SOC, ISO, and other security compliance reports

- Participate in security operations and consultation support

We are open to hiring candidates to work out of one of the following locations:

Arlington, VA, USA | Mono Hot Springs, CA, USA | San Francisco, CA, USA | Seattle, WA, USA | Sumner, WA, USA

Basic Qualifications

- Bachelor’s degree in Computer Science, Information Systems, Cyber Security, or 5+ years relevant work experience
- 2+ years of application security experience
- 2+ years of SaaS security experience
- 2+ years of PaaS cloud security experience
- Experience with host, system, and network security, authentication and security protocols, cryptography, and application security
- Experience with the application of threat modeling or other risk identification techniques
- Experience building with AWS, or other major cloud service providers
- A strong ability to communicate technically complicated subject matter using uncomplicated language.

Preferred Qualifications

- Advanced/Master's degree in Computer Science, Information Systems, or Security
- Experience implementing security solutions at the business division level
- An understanding of network and web related protocols (such as, TCP/IP, UDP, IPSEC, HTTP, HTTPS, routing protocols)
- Experience with multiple programming languages (such as, JavaScript, R